Another new user asking questions

I am hoping to get my new HD today and am planning to put XP on it CLEAN.

Just one question ( for now )

I would like to get it installed with nothing other than Administrator ( if possiblle ) as I have no need for a multi-user setup.

When I had it before I had Admin and two users with no idea how the users wormed their way in.

BillyBob

 

BillyBob

Use at least 2 user accounts. The administrator account with password and a BillyBob account.

Use only the BillyBob account untill something scre*s up. Then you have another way in to fix things. Especially handy if the password get walked on!

This is not my idea but is advised by M$ and has been used by the pros since NT came out. And is pretty much the number one login rule of System Administrators.

Additionally you can use this to protect you from yourself somewhat by adjusting the security level of your own logon down (to say Power User level) so that it limits you automaticly from doing certain things that can damage the system by mistake. Like installing programs that replace system files.

I have even an additional account set up called "Special" that has only "User" rights. This is a very safe security level where things can be run but system files cannot be deleted or moved nor programs installed, plus more. I use this when someone wants to use my computer without my supervision or some time visiting children. I don't let just anyone use my computer but some close friends and family I can't say no to.

Additionally you can remove access to email and the web or specific apps for this user.

Use this feature it is nice! Don't think that these individual user accounts are just new tinker toys of XP, they are practical and useful! And after reading below you will understand why they are an absoloute nessesity in Coprorate America. But still handy at home!

Below is a description of access rights. This is from the help on my 2K but XP is the same with a few exceptions or new items.
-------------------------------------------------------------------------------
Default security settings
The default security settings for Windows 2000 can be described by summarizing the permissions granted to four default groups (Administrators, Power Users, Users, and Backup Operators) and three special groups.

Administrators

Members of the Administrators group can perform all functions supported by the operating system. The default security settings do not restrict administrative access to any registry or file system object. Administrators can grant themselves any rights that they do not have by default.

Ideally, administrative access should only be used to:

Install the operating system and components (such as hardware drivers, system services, and so on).
Install Service Packs and Windows Packs.
Upgrade the operating system.
Repair the operating system.
Configure critical operating system parameters (such as password policy, access control, audit policy, kernel mode driver configuration, and so on).
Take ownership of files that have become inaccessible.
Manage the security and auditing logs.
Back up and restore the system.
In practice, Administrator accounts often must be used to install and run programs written for previous versions of Windows.

Users

The Users group provides the most secure environment in which to run programs. On a volume formatted with NTFS, the default security settings on a newly installed system (but not on an upgraded system) are designed to prevent members of this group from compromising the integrity of the operating system and installed programs. Users cannot modify system-wide registry settings, operating system files, or program files. Users can shut down workstations, but not servers. Users can create local groups, but can manage only the local groups that they created. They can run certified Windows 2000 programs that have been installed or deployed by administrators. Users have full control over all of their own data files (%userprofile%) and their own portion of the registry (HKEY_CURRENT_USER).

Users cannot install programs that can be run by other Users (this prevents Trojan horse programs). They also cannot access other Users' private data or desktop settings.

To secure a Windows 2000 system, an administrator should:

Make sure that end users are members of the Users group only.
Deploy programs, such as certified Windows 2000 programs, that members of the Users group can run successfully.
Users will not be able to run most programs written for previous versions of Windows because previous versions of Windows either did not support file system and registry security (Windows 95 and Windows 98) or shipped with lax default security settings (Windows NT). If Users have problems running legacy applications on newly installed NTFS systems, then do one of the following:

Install new versions of the applications that are certified for Windows 2000.
Move end users from the Users group into the Power Users group.
Decrease the default security permissions for the Users group. This can be accomplished by using the compatible security template. For more information, see "Predefined security templates" in Related Topics.
Power Users

Members of the Power Users group have more permissions than members of the Users group and fewer than members of the Administrators group. Power Users can perform any operating system task except tasks reserved for the Administrators group. The default Windows 2000 security settings for Power Users are very similar to the default security settings for Users in Windows NT 4.0. Any program that a User can run in Windows NT 4.0, a Power User can run in Windows 2000.

Power Users can:

Run legacy applications in addition to Windows 2000 certified applications.
Install programs that do not modify operating system files or install system services.
Customize system-wide resources including Printers, Date/Time, Power Options, and other Control Panel resources.
Create and manage local user accounts and groups.
Stop and start system services which are not started by default.
Power Users do not have permission to add themselves to the Administrators group. Power Users do not have access to the data of other users on an NTFS volume, unless those users grant them permission.

Warning

Running legacy programs on Windows 2000 often requires modify access to certain system settings. The same default permissions that allow Power Users to run legacy programs also make it possible for a Power User to gain additional privileges on the system, even complete administrative control. Therefore, it is important to deploy certified Windows 2000 programs in order to achieve maximal security without sacrificing program functionality. Programs that are certified for Windows 2000 can run successfully under the secure configuration provided by the Users group. For more information, see Securing Windows 2000 Installations at the Microsoft Security Advisor Web site.
Since Power Users can install or modify programs, running as a Power User when connected to the Internet could make the system vulnerable to Trojan horse programs and other security risks. For more information, see "Why you should not run your computer as an administrator" in Related Topics.


Mike

 

Hi Christer

No BUT-IN this is a public forum. We do address our answers to a specific person most times but it is for everyone.

Security is nothing without passwords. You can have a blank password and logon to an NT class OS, but it will not let you access shares on other NT class computers on a LAN without a password. Now they could access shares on a 95-98 or ME station.

Additionally if you did set up an Administrator and User with no password then all the User has to do is logoff and back on to the Administrator account.

There are many ways to autologon (with or without passwords) the most common being TweakUi!

[If I log in as a "user ", will Windows Update notify me of updates?] Well hopefully Christer you are not Using M$ Critical update reminder but are visiting Windows update regularly at your discretion. But yes if you set the User to allow this it will!

As for installing and running disallowed programs.

1. Log off as a User and back on as Administrator.
OR!
2. While logged on as a User use the RunAs function which will prompt for and Administrator username and password.

Additionally there is much more that can be done to fine tune a users access, from adjusting more privileges and rights to editing the Profile so that only what you want will show up in his Windows Start menu!

Mike

 

Just wanted to add: having two screenames is nice to have so you can fix things when they get whacked. But XP has a built in Admin. screename that can be accessed using safe mode. If you only have one sn and it gets ******* up, you can go into the admin in safe mode and take the password off, or do whatever you need.

 

All users with Admin rights can get the updates and have them installed. You do not have to log in as Administrator to do that.
XP requires 2 accounts, the Administrator, and one user. As long as there's only one user, you will not get prompted for a password (unless you WANT to), and will automatically be logged into the main account. You can do (almost) everything there, that you would do in the Admin.
Software that is installed under the user, will be accessible to all users, unless they are limited.

Hint: Set up two users, clone user 1 to user 2, and if user 1 screws up, just delete it, and use the second acct. Re-clone, etc...It's much quicker and more reliable than system restore.

 

Well Christer now at least you know how to do all (when you get Pro) as I covered in my last message.

BUT! It all applies to 2K or XP Pro. XP Home is neutered. Many of these are not available in Home! When you said Limited I knew!

There are ways to get close using GPedit but......

You can use the limited and fine tune some.

Sorry but I never seem to consider XP home, I wonder why!

Mike

 

Christer

I rechecked and noticed that you posted in the XP forum, (often I forget what forum I am in) and also read your Signature.

It says Windows ME (course I didn't read it anyway the first time) so you may want to edit that for people that do read it! Smile!

And make sure to note XP "Home "! makes a big difference in what is available and what you can do as opposed to XP Pro!

mike

 

I have never seen his on XP pro and I have installed many, but it may be the way you installed it!

It is probably because you are using the native XP Theme/view. I use only the Classic View. So I never see this

See this:
http://network.fament.com/helmig/j_helmig/wxphusrm.htm

http://www2.cajun.net/~theriots/xpsitefolder/win_xp_passwords.htm


Mike

 

You didn't read the links I sent huh!

The below is from the 2nd one!

1. Click Start, and then click Run.
2. In the Open box, type "mmc" (without the quotation marks), and then click OK to start MMC.
3. Start the Local Users and Groups snap-in.
4. Under Console Root, expand "Local Users and Groups ", and then click Users.
5. In the right pane, right-click Administrator, and then click Set Password.
6. Click Proceed in the message box that appears.
7. Type and confirm the new password in the appropriate boxes, and then click OK.

The above uses the Administrator but you can chose who or what.

But anyway Christer it is because you are not running the classic view but are in the Std XP theme!


Mike

 

I too, am constantly referring to Pro, as I consider Home to be a neutered version.
If you DO have multiple users, and find that an Admin priveledge account is too "open ", and also find that a limited account is too "limited ", then mflynn has explained the procedure to set certain limits on an admin account, by far the best option.

There is always more than one way to skin a cat, as such, there is more than one way to install XP

I switch to Classic, make any necessary changes, and then switch back to my custom XP theme. It makes it slightly more difficult for (limited) users to change the start menu as well.

 

Just an FYI: How to install XP from DOS: http://support.microsoft.com/default.aspx?scid=kb;en-us;307848&FR=1&PA=1&SD=HSCH