Shared Computers at Work: How to Keep Shared Devices Secure

Almost every business we visit has one: the computer that everyone uses. It might be the reception PC, the workshop computer in a garage, the tablet a care team passes round at handover, or the laptop in the meeting room. It’s usually signed in to one account, the password is on a sticky note, and nobody can quite remember who set it up.

Shared devices make sense. Not everyone needs their own computer. But a device that everyone uses with the same login is often the weakest spot in a small business. Here is why, and how to keep shared computers handy without leaving the door open.

Why shared logins are a problem

When five people use one account, you lose three things at once.

You can’t tell who did what. If an invoice is changed, a file is deleted or a dodgy link is clicked, the records just show “the reception account”. That makes it hard to put things right and impossible to learn from it.

Leavers never really leave. If the password is shared, everyone who has ever worked there knows it. Unless you change it every time someone goes, a former employee can still sign in.

Everyone’s data mixes together. On a shared account, the browser remembers everyone’s saved passwords, the email app may be signed in to someone’s personal inbox, and the downloads folder holds a mix of payslips, customer details and photos. If that device is lost, stolen or infected, all of it goes with it.

It also matters for certification. The UK government’s Cyber Essentials scheme requires businesses to “authenticate users with unique credentials before granting access to applications or devices”, and to remove or disable accounts that are no longer needed. In plain English: each person signs in as themselves, and old accounts get switched off. A shared login on a work computer makes that hard to show.

The good news: shared devices don’t need shared accounts

Many businesses use one login because signing in and out feels slow and fiddly. Microsoft has spent years fixing exactly that, and the tools are probably already included in what you pay for.

Shared Windows computers

Windows 10 and 11 have a feature called Shared PC mode, which is designed for computers several people use. Each person signs in with their own work account, and the computer can be set to tidy up after them. Your IT team can choose to:

• delete each person’s account from the computer when they sign out, or when disk space runs low, so files and saved passwords don’t build up
• stop people saving files to the computer itself, so work goes into OneDrive or SharePoint, where it’s backed up and kept private
• ask for a password when the computer wakes from sleep, so a computer left unattended doesn’t stay open
• offer a guest account that is wiped at sign-out, for visitors or temporary staff who only need a web browser

If your computers are managed through Microsoft Intune (Microsoft’s tool for managing company devices, included in Microsoft 365 Business Premium), these settings can be applied to every shared computer from one place, rather than set up by hand on each machine.

Microsoft Office on shared computers

There’s a catch that trips up a lot of businesses. When several people sign in to the same computer with their own accounts, Word, Excel and Outlook need a setting called shared computer activation. Without it, Office may complain about licensing or drop into a “reduced functionality” mode where people can read documents but not edit them.

Microsoft’s guidance is that each person needs their own Microsoft 365 licence and signs in as themselves. Microsoft 365 Business Premium is the only Business plan that supports shared computer activation. Business Basic and Standard don’t, so if you have shared computers it’s worth checking your plan. Our guide to which Microsoft 365 plan your business needs explains the differences.

Shared phones and tablets

For tablets and phones that get passed around, such as in care homes, warehouses or on the shop floor, Microsoft offers shared device mode for Android, iPhone and iPad. A member of staff signs in once at the start of their shift and gets their own Teams and work apps. When they sign out, they’re signed out of the device and every supported app in one go, and their data is cleared ready for the next person.

Simple habits that make a big difference

Even before any settings change, a few habits help straight away:

• Lock it when you walk away. On Windows, press the Windows key and L together. It takes a second.
• Set an automatic screen lock. A few minutes of inactivity is plenty for a shared computer in a busy area.
• Use a proper PIN or password. Cyber Essentials asks for a PIN or password of at least six characters where the device allows it, and for the device to limit guesses (no more than 10 tries in 5 minutes) or lock after 10 failed attempts.
• Don’t save passwords in the browser on shared machines. Use a password manager instead, so each person’s passwords stay theirs.
• No personal email or accounts. A shared work computer is not the place to check personal email or social media.
• Keep it updated and protected. Shared computers are often forgotten when updates are done, because nobody “owns” them. Make sure they get the same updates and virus protection as everyone else’s.

What about the computer that runs one program?

Some shared computers only need to do one thing: the garage’s parts lookup, a sign-in screen in reception, or a display in the workshop. For these, Windows can be set up as a kiosk, where the computer only runs that one app and nothing else. Nobody can browse the web, open email or install anything, which takes away most of the risk.

Where to start

You don’t need to change everything at once. A sensible order is:

1. List your shared devices. Every computer, laptop, tablet and phone that more than one person uses. Note what each one is for and which account it signs in with. Our article on IT asset management tools has ideas for keeping that list up to date.
2. Decide what each one needs. A full shared computer, a kiosk for one program, or a shared tablet.
3. Check your licences. Make sure everyone who signs in has their own account, and your plan supports shared computers.
4. Change the passwords on any shared account that stays, and remove anyone who has left.
5. Switch on the settings above and test them with the people who actually use the device. If signing in is quick, they’ll stick with it.

How we handle shared devices

Shared devices come up in almost every free IT audit we do, especially in care homes, garages and charities where staff work in shifts. As part of our Get It Green process, we list every device, flag shared logins in red or amber, and then set them up properly so each person signs in as themselves without slowing anyone down. Because our clients pay a fixed monthly fee, we’re rewarded for preventing problems, not for fixing them, so getting this right early suits everyone. You can read more about how we protect businesses on our cyber security page.

Need a hand?

If you’re not sure how many shared logins your business has, or you’d like the reception PC or workshop tablet set up properly, we’re happy to help. Book a free IT audit or a 30-minute call and we’ll take a look with you.