Re: Tweaking security on XP Pro machine

Hi,

You can edit local policy and add a user account into "Deny logon locally"
policy. Be careful with groups here since you can lock yourself out.
You might also want to add that username to the policy named "Deny logon
through Terminal Services"

Deny logon locally
http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/537.mspx

Deny log on through Terminal Services
http://technet2.microsoft.com/WindowsServer/en/library/4486e498-dd7c-4882-ab58-dcf663d2dea21033.mspx?mfr=true

Since you are not going to use EFS with this username / account you can
disregard that message when reseting the password. For all other accounts
use "Change Password" instead of "Reset Password" if you plan to use EFS.
You will find change password option if you logon with user account and then
e.g. hit ALT+CTRL+DEL and there will be a "Change Password" button.

--
Mike
Microsoft MVP - Windows Security

"Wowbagger" <none> wrote in message
news:uxm1OhXuGHA.3964@xxxxxxxxxxxxxxxxxxxxxxx
My XP Pro sp2 machine is doing double duty as a file server for a small
workgroup. No domains are involved. I have created a local user that is
used when I map the shared drive from the other machines but have two
questions:

1. How can I prevent anybody from using this username/password to log on
locally

2. From time to time I'd like to be able to change/reset the password.
When I try to do so I get the message indicating that if I change the
password all of the EFS files will forever be locked, etc - how can I
relax the security settings to allow the admin (me) to reset/change the
password at will and not create any of those issues?

Thanks




.

Loading