Guest account abilities

I activated the Guest account on my comp because my bf's gonna be staying here for the next two weeks while I finish up my business in MI. I want him to be able to play Unreal Tournament 2004 and browse the Web, but I don't want him to be able to change any of my settings, nor access message boards with my accounts.

Do I need to make another Firefox profile for him? Can I keep the Guest account from viewing the My Documents folder on my second HDD? I know each account gets their own My Documents, but will he be able to see my documents because I changed the location to my other HDD?

 

If you have everything you need on the other drive, just lock the drive out. But be sure to set it where you lock out GUEST only or you might lock yourself out, too!

Anything on that drive will not be accessible to anyone else.

 

I'd create the Guest account and try it. Log on. Save a couple of files.

 

How do I lock someone out of my drive? I need step-by-step instructions.

 

XP-pro or XP-home? The directions will be somewhat different.

 

Pro.

 

Well all righty then and whew, glad it's pro since things are lots easier with that version.

- Log on using an account with admin rights
- Right-click My Computer and left-click manage the go to the Local Users & Groups section
- Create a new account. I suggest a different account for each person who will use the PC and an account/login name that will let you easily identify who is who.
- Follow the pictures to see account creation details and how to lock the account down to the 'guest' level which can do very little.
- I can't put all 6 pictures on this post (max is 5) so continuing on another reply

 

- With the account a member of Guests and not a member of any other group, you only need to make sure that you have not given 'Everyone' (another group that will include a Guest group account) permission to see the drive you want to block. Another couple of pictures showing details of doing this.

Let me add a caution here to go along with the same caution in one of the pictures but more general. When you are tweaking permissions, avoid using the Deny section for controlling what folks can see. It works but way too easy to shoot yourself in the foot and not be able to recover. From the example where you want to deny access to an entire drive, I show deleting the 'everyone' group from the list of allowed access. If you opted to deny the group any access, you would literally be denying 'everyone' access to the drive and that would include you.

Removing groups, adding groups, easy enough to do but be very careful about doing anything to 'Everyone' except removing it AFTER you make sure there will still be a group with access and that your account belongs to that group.

 

OK I followed the instructions. Do I need to remove Uses too, or just Everyone? Thanks again.

 

Newt, ya coulda saved yourself some typing! From my notes, credited to you:

Denying Users Access
Great. Dead easy with the Pro version.

To deny them any access to G: open windows explorer then right-click on G: and left click on the Properties tab. Security tab and delete any users except yourself. Done deed.

Note: DO NOT leave the users and click on any of the deny blocks. Tain't safe. Just remove their accounts altogether.

Note2: Be sure not to remove yourself. Or be safe and create another account that you don't plan to use often but can in an emergency. Add that account to the Administrator group (right-click My
Computer, left-click Manage then local users and groups) and then add it to security for the drive.

Do the same for any drives you don't want others to be able to access.

Added safety feature for the drives you want others to be able to use - place all their user accounts in the Users group and remove them from any others. That way no one but you will have permissions adequate to do any serious system tweaking so no one can accidently trash the PC. Do note that this will prevent them from installing new apps though so you'll have to do that if it's needed.

Restricting Users

Install programs for selective users?
some programs, if installed by a particular user of a muti-user system will only be shown to that user, while some programs, no matter who installs it shows itself to all users...
Is there a way to force an installation of a program to only be usable by certain users of a multi-user system?

Answer:

- in Documents & Settings, check the 'all users' account and if the shortcut is there, remove it and put it in the admin account. Users won't see it then.

- in the folder containing the .exe file, go into security and make sure the administrator account has full access then remove/delete any other users and groups (everyone is probably there now).

No one except Admins will see the shortcut and if a user knows to go to the exe and run it, it will not let him/her.

If you run XP-Pro you can just use Windows Explorer when logged on as an administrator to do the above.

If you run XP-Home, you will have to boot to safe mode as the administrator to even see the security tab for the folder.
all from Newt

Johanna

 

This is great stuff....Maybe should be a sticky?

 

LOL - I'd forgotten about that stuff but in any case, I had fun doing up the pretty pictures.

Bmoore1129 - I may try to do a somewhat more generalized version for that. This one was aimed at a particular level of user expertise since I knew shadowhawk could get by with some detail missing.

shadowhawk - you can leave the 'users' group with access as long as the only group membership the new account has is Guest. XP-pro (and especially if you use NTFS) allows lots of fine tuning of security both for a local login and for network access. 2K does as well.