Creating restricted user accounts

i read the sticky on how to protect myself against malware, and its great.

i have a question: in order to be protected from malware, are there certain settings that i gotta enable or disable for non-administrative accounts? is so, what and where do i do it?

i went in the control panel, and made a user account, but i dont see any options there about how i could limit it.

is that all i gotta do to be safe, just create an admin and user account and password them both? or are there settings to tweak on order to make the user account safer from malware?

i use windows 7.