Can I remove admin permissions from main account then create new one?

Question

I have heard that it is considered best practice to use an account that does not have administrator permissions for normal use, especially when connected to the internet for safety reasons. I am the only user of my Macbook and only have one account, the one that was created when I first used the computer. I obviously don't want to have to start all over again and so is there a way that I can safely create a new account, give it administrator permissions that I would use just for times when I need to make system changes and remove the admin permissions from my first account so that I don't have to migrate all my files and setting to a new user account?

Answer 1

Yes it is, for security reasons. When you log in as an administrator, everything you do, every command you run, runs with admin privileges. If you open a trojan or other malware as an administrator, you hand over much of your system to the malware. By running as non-admin, only the contents of your home folder are vulnerable.
Consider a trojan that modifies Safari, so that next time you make an online purchase, Safari captures your credit card number and sends it to a third party. If you opened that trojan as an administrator, the trojan could install itself without your knowledge. If you were running as non-admin, it would have been stopped in its tracks.
If you need any more convincing, you can read what Apple has to say about it:
Each user needing administrator access should have an individual administrator account in addition to a standard or managed account. Administrator users should only use their administrator accounts for administrator purposes. By requiring an administrator to have a personal account for typical use and an administrator account for administrator purposes, you reduce the risk of an administrator inadvertently performing actions like accidentally reconfiguring secure system preferences.
Unless administrator access is required, you should always log in as a nonadministrator user. You should log out of the administrator account when you are not using the computer as an administrator.
(from page 42 of this document)