Run Program as Different User for Security

Question

Is it safer running a program you don't trust very much or you don't want to give full access to your system as different user? Is the program which is run as different user "limited" in what it can read and write in the system? If so limited to what?

I tried this feature and I noticed that the program which is run as different user seems to not have access to the whole system, (for example if you run a browser as different user and want to upload a picture online, the browser can only read the folders and files of the user it is run as), is it right?

Can someone please explain what are the effects/advantages of running a program as different user in windows 10 and if is actually safer to run a program as different user? also if running a program as different user is similar to running a program in a sandbox.

Answer 1

In general running a program as standard user you have limit access to resources and it is safer.
For this reason Microsoft developed a feature called UAC where even if you are login as administrator, your programs will run as standard users and when they need to access administrative tasks, you will see a notification and permission.
This feature would make it possible to use a program with lower access under administrator account without having to setup a new account. Take a look at:
https://learn.microsoft.com/en-us/windows/security/identity-protection/user-account-control/user-account-control-overview
In general it is recommended to never run untrusted programs in Windows and in case you want to do it, try run it inside a Virtual Environment.
One recommended approach is run untrusted programs (if you have to) on Windows Sandbox , take a look at:
https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview