What are the TWO BEST practices for managing user accounts?

Users should only be granted the level of access they need, in accordance with the principle of least privilege. If a user needs to read files but not change them, then they should be restricted to reading those files only. Even the most careful users occasionally make changes they did not intend. A user shouldn't be permitted to log in on the weekends if they only work Monday through Friday. The availability of their login allows a hacker one additional way to get into your system. The Guest account is by default disabled and should remain disabled. Even administrators should use a standard user account unless they need administrative access to do a certain task. Only in that case should they on as an administrator.