Give every person a separate Windows identity
Microsoft recommends distinct user accounts on shared devices because each person gets separate settings and documents. Standard accounts reduce routine privilege, but administrators can still have broad control and require special trust.
A household PC has one administrator login used by everyone. The owner creates named standard accounts, relocates each cloud sync client into the appropriate session and tests cross-account access before deleting no-longer-needed local copies.
Run the control in five steps
- 01Create one named Windows account per regular user.
- 02Keep daily accounts standard unless administration is required.
- 03Sign into each cloud client only in the intended Windows profile.
- 04Review folder ownership and permissions for inherited access.
- 05Lock, switch and sign out while testing cross-account visibility.
Preserve an accountable test record
Keep Windows account, type, cloud accounts connected, synced paths, permission review, cross-account test, administrator exception and approval.
Stop and investigate when
- Everyone knows the same Windows password.
- Every person has administrator rights.
- A cloud client remains signed in inside a shared session.
State what the control does not prove
Cloud Secure protects PC-side cloud-sync folder access, not Google/Dropbox/OneDrive provider-side TLS, E2EE or share permissions. Verify provider sharing, locally resident copies, Windows access and recovery separately.
Cloud-folder privacy questions
Are separate Windows accounts a complete security boundary?
They improve separation, but administrators, permissions and local copies still require review.
Should every user be an administrator?
No. Microsoft advises limiting administrators and using standard accounts for daily work.
Sources for this decision
These sources support the stated boundaries and do not imply endorsement.