Re: ADMINISTRATOR vs Administrator USer

AIANDAS wrote:
Aren't there various flavours of users, i.e., power user et al? Can
these be designated as administrator or how do I define one
administrator as a power user and another not?
Is there a link that give me detailed info on administrators and
various flavours of users?

Let's make this easy.

If a user is a member of the "administrators" group - they are all-powerful
(except in personalized worlds - like encrypted data - and even then, they
could (if the other users are unwise in their best practices) make said
encrypted data *lost* to the other user completely.)

If a user is a member of the "administrators" group - no matter their other
memberships - they can do what they want to whom ever they want on said
system. If another member of the "administrators" group changes something
on their account, they can retaliate and do the same.

As far as I am concerned (the following is my opinion, my take on things) -
despite some people's usage of the "power users" group - there are only a
few levels of users.

When dealing with users - you give them *as little* power as
possible/plausible and grant them only the additional power they need. You
do not give them 'all powerful' rights and then try to limit them.

- Guest (these people cannot do much of anything, fairly unused level.)
- User (very limited, no installation rights, etc.)
- Modified User (this is not a built-in group, but a user whom I have
granted an extra right or three...)
- Administrator (full ownage of everything in said system.)

Power Users is supposed to be a group that can install certain things, do
certain things - but I have always found their power too broad to be useful
in restricting people. Power Users still get infections that affect all
other users, they can install software that affect all other users, etc.
I'd rather not have that sort of user on a multi-user system and I would
rather only have a single administrator (although there may be multiple
adminstrator level accounts - for 'oops' situations.)

My suggestion is to limit the usage of the "administrators" group as much as
possible. Create all "users" and if you must, grant certain users 'special
powers'.

http://technet.microsoft.com/en-us/library/bb456992.aspx
http://support.microsoft.com/kb/279783

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html


.

Relevant Pages

  • Re: adding power user rights when computer is in a workgroup
    ... PU group exists after I do install. ... the user a member of, only choices are Admin or Limited user. ... the Power Users group when in a workgroup setting. ...
    (microsoft.public.windowsxp.general)
  • Re: ADMINISTRATOR vs Administrator USer
    ... Shenan Stanley" wrote: ... these be designated as administrator or how do I define one ... Power Users is supposed to be a group that can install certain things, ...
    (microsoft.public.windowsxp.general)
  • Re: Local user privileges
    ... member of the power users or administrators. ... If he can create admins, then he is a member of the local admin group. ... or if you made the dom-user account a local administrator. ...
    (microsoft.public.win2000.group_policy)
  • Re: What right allows full access?
    ... did when you granted Full to Power Users. ... loaded during install. ... >>> I don't want to run Windows XP as an Administrator because of Viruses ... Log off from the admin account until ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Roaming Profiles & Local Permissions
    ... as Domain Power Users though a domain user can be in the local power users ... When the administrator logs in, ... but anyone other than administrator cannot install the program. ...
    (microsoft.public.windowsxp.security_admin)