During IT audits, we routinely see banks granting all or some of their users local administrator rights on their PCs. They are usually forced into allowing this level of access due to some software that will not work correctly without local administrator rights. However, they can mitigate some of the risk by using a utility called DropMyRights.
In a recent Security Now! podcast, Steve Gibson talked about the DropMyRights utility. It was written by a Microsoft engineer. It allows you to run specific programs with less rights than your user account normally has. For example, if you are given local administrator rights because the core banking software requires it, you can use DropMyRights to help protect yourself when running web browsers or your email client. Simply create a shortcut for each program using DropMyRights in the command line. For example, you could use the following command line to run Internet Explorer under a non-admin user context: [more]
C:\utilities\dropmyrights.exe "c:\program files\internet explorer\iexplore.exe"
Links to the utility and supporting documentation can be found on Steve Gibson’s website: http://www.grc.com/sn/notes-176.htm