MS is responsible for creating admin accounts by default (not sure it still does though ;p)
Ask for an administration password at install time and ask the user to create a user account too, then don't allow any other admin account to be created. (or something like that)
"Responsible"? It is by design - in any OS with a UNIX-like security model, someone has to have full control of the system. And if you are not going to have control of your own personal computer, then who exactly should have it?
(Not to mention that consumer versions of Windows did not really have any security and access control mechanism before Windows XP, since NT/2000 were strictly "business" branded versions).
Even today, the default user account is an administrator - Windows 10 does not change that. However
"User Account Control" (UAC), available since Vista, restricts full "Administrator" rights to standard "User" rights do prevent harmful code from running automatically. Most admin actions require a temporary elevation requested with a scary dialog box - but then again, "clever" users got around the practice by automatically approving all UAC prompts.
What now - will you require a Microsoft support technician to review and approve every potentially stupid action by the end user? Or maybe implement some cloud-based super AI capable of doing the same, and not forget to implement strict compliance to
the Asimov's Laws of Robotics?
I installed Windows 10 and don't remember what type of account it creates, I assume it's still admin since I could install software... which is wrong.
Microsoft did recommend creating a standard user account to run everyday tasks - but most people never did. In fact most of them never even bothered to set a non-empty Admin password.
I tried this setup when I had a Windows 2000 installation, and it didn't really work. Having to switch the user accounts to do even most simple tasks like changing the display resolution was too cumbersome. So when I upgraded to Windows XP, I just left the admin account and installed as many antivirus, firewall antimalware tools as I practically could.
(BTW it didn't help - in the end, my Windows installation was infected with almost all kinds of rootkits which appeared at the height of 2002-2003 Windows malware wave targeted at pre-SP3 vulnerabilities, but that probably had nothing to do with having admin user rights because these viruses were using buffer overruns, malformed pages and other exploits to get system access).
I'm not implying it's the same code, I'm just saying that in practice it doesn't make much difference to typical users.
Nothing makes difference to typical users as long as you maintain the Start button in the bottom left of the Task Bar and Close button in the right top corner of the application window, and as long as their version of Windows runs on their current hardware.
My Windows 2000 PC was a Pentium III 700 MHz with 128 Mbytes of RAM, Riva TNT 16 MB and 15 GByte hard disk. My current Windows 10 PC is a Core i5-2500K 3.2 GHz (4-core) with 16 Gbytes of RAM, Radeon R9 290X 4GB and 12 TBytes of storage. Does a 100x difference in processing performance and 1000x difference in memory/storage capacity really make any practical difference?
Yes, fragility due to millions of lines of code and ever-changing APIs, and the same happens to Unix btw. Users will get owned regardless of their access privileges unless you go Apple-style and do an App Store in a closed platform like iOS.
That's the point. The only freedom Unix-like security model offers to casual non-technical user in today's connected world is a freedom to get instantly infected with a virus. If they can't take the responsibilities of running under admin account knowing what they are exactly doing, the Windows Store is the best solution for them.