Do windows users follow the principle of least privilege?: investigating user account control practices