Re: Restriction

Hi Jon.

That is not true. Only a user that is also in the local administrators group
can manage membership in the local administrators group. What I would do is
to make sure that the membership of the local administrators group is what
you expect which can easily be done with the command net localgroup
administrators. If you remove a user from the administrators group and then
try to have them add themselves back make sure you first logoff as that user
to refresh their security token to reflect they are no longer a member of
the administrators group. Try it again with a user that you know for sure is
only a member of the users group. You can use the command net user username
to see a user's group membership under local group memberships. Also make
sure that the administrators group contains only individual users and not
any groups such as everyone, authenticated users, or interactive. --- Steve


"Jon" <Jon@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:D210866B-ACAA-4B8D-873E-4C1D72BBECB6@xxxxxxxxxxxxxxxx
Thanks, but I'm not sure I understand this; any user with any kind of
account
on XP can simply go in through Control Panel, into User Accounts, click on
'change my account type' and make themselves administrator.

My question is, as administrator, how do you change the limited account
settings so that they can no longer make themselves administrator?

"Steven L Umbach" wrote:

A regular user can NOT add themselves to the local administrators group.
What may have happened is that the built in administrator password is
blank
and they used that. That is very common in XP Home and can be changed by
booting into Safe Mode to access the administrator account. Any user that
is
also an administrator must also use a strong password that can not be
guessed. Another possibility is that they used a free utility to boot the
computer from a floppy or cdrom to change the built in administrator
account
to gain administrator access to the computer. Though not foolproof it can
help if the computer's cmos settings are password protected and
configured
to allow the computer to boot only from the hard drive. Given enough
time,
determination, and skill any computer that can be physically accessed by
a
malicious user can be taken over by that user. --- Steve



"Jon" <Jon@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:787104D2-F26B-4AC2-BA24-A80A44D8DC78@xxxxxxxxxxxxxxxx
I've put myself on the XP system as administrator and my partner's kids
on
limited accounts. To my horror, a limited account user can change
*themselves* to administrator, with all that that gives acess to, and
there
appears to be no way in XP to stop this. Is there any way to truly
limit a
limted account, and why would XP have what's effectively an unlimited
limited
account anyway? Or have i just missed something really obvious?

Jon


"Brandon" wrote:

Thanks for the help. It worked the way I wanted and more than I
expected.
-Brandon

"Mike Bright MSP" wrote:

Brandon,

Ok, so you can use Doug's tool for this one,

Login to your sisters account and run Dougs "Security Console" tools
and you
can disable Desktop changes and a number of different settings in
their.
Apply the settings then log off. The next time your sister logs in
it
will
apply the restirctions. Dougs tool is available from:

http://www.dougknox.com/xp/utils/xp_securityconsole.htm

The two options groups and the program to look at are "Disaply
Options"
and
"Desktop Settings".

Regards

Mike Bright MCP, MSP

e:mike.bright@xxxxxxxxxxxxxxx








.

Relevant Pages

  • Re: Remote desktop: cannot copy files why still not working
    ... I created a new user on the XP box, set as an administrator ... this new user account is local to the XP system, ... In my environment, when I do an RDP connection to a server, I first log ... member of the local administrators group on the server. ...
    (microsoft.public.windows.server.security)
  • Re: Remote desktop: cannot copy files why still not working
    ... this new user account is local to the XP system, and a member of the local administrator's group on that workstation. ... In my environment, when I do an RDP connection to a server, I first log on to the xp workstation using my regular, non-privileged domain account, run mstsc, and then logon to the server using a domain account that is a member of the local administrators group on the server. ... In addition, I frequently use runas to run privileged applications on the workstation using my "administrator" account, and have found that files cannot be copied between those applications and anything running under the credentials of my regular account - even though my administrator account actually does have full access to everything on the workstation - just not through my regular account's view of that workstation. ...
    (microsoft.public.windows.server.security)
  • Re: XP Home with Two Administrators - Aggravations
    ... Check the group membership of the user and administrator to see if both users have the same group membership. ... In XP Home you need to boot into Safe Mode and logon as an administrator to examine folder NTFS permissions to see if there are any permissions that may be causing the problem. ... My understanding is that Administrators should be able to view and work with system folders, change Internet settings, etc. ... In addition, when the first administrator changes personal settings, they often propagate to the other administrator's account. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Built In Admin account vs Created one
    ... The built in administrator account is a member ... of the local administrators group and that is where it gets its power. ...
    (microsoft.public.win2000.security)
  • RE: local administrator on a domain controler...
    ... Account Operators (which can log on locally, Shut down the system and has ... including its own membership and that of the Server Operators. ... a service administrator because it can modify Server Operators, ...
    (microsoft.public.windows.server.active_directory)