Re: ADMINISTRATOR vs Administrator USer

Shenan
Thank you very much this was very insightful.

Shenan Stanley" wrote:

AIANDAS wrote:
Aren't there various flavours of users, i.e., power user et al? Can
these be designated as administrator or how do I define one
administrator as a power user and another not?
Is there a link that give me detailed info on administrators and
various flavours of users?

Let's make this easy.

If a user is a member of the "administrators" group - they are all-powerful
(except in personalized worlds - like encrypted data - and even then, they
could (if the other users are unwise in their best practices) make said
encrypted data *lost* to the other user completely.)

If a user is a member of the "administrators" group - no matter their other
memberships - they can do what they want to whom ever they want on said
system. If another member of the "administrators" group changes something
on their account, they can retaliate and do the same.

As far as I am concerned (the following is my opinion, my take on things) -
despite some people's usage of the "power users" group - there are only a
few levels of users.

When dealing with users - you give them *as little* power as
possible/plausible and grant them only the additional power they need. You
do not give them 'all powerful' rights and then try to limit them.

- Guest (these people cannot do much of anything, fairly unused level.)
- User (very limited, no installation rights, etc.)
- Modified User (this is not a built-in group, but a user whom I have
granted an extra right or three...)
- Administrator (full ownage of everything in said system.)

Power Users is supposed to be a group that can install certain things, do
certain things - but I have always found their power too broad to be useful
in restricting people. Power Users still get infections that affect all
other users, they can install software that affect all other users, etc.
I'd rather not have that sort of user on a multi-user system and I would
rather only have a single administrator (although there may be multiple
adminstrator level accounts - for 'oops' situations.)

My suggestion is to limit the usage of the "administrators" group as much as
possible. Create all "users" and if you must, grant certain users 'special
powers'.

http://technet.microsoft.com/en-us/library/bb456992.aspx
http://support.microsoft.com/kb/279783

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html



.

Relevant Pages

  • Re: ADMINISTRATOR vs Administrator USer
    ... these be designated as administrator or how do I define one ... If a user is a member of the "administrators" group - no matter their other ... Power Users is supposed to be a group that can install certain things, ...
    (microsoft.public.windowsxp.general)
  • Re: What right allows full access?
    ... did when you granted Full to Power Users. ... loaded during install. ... >>> I don't want to run Windows XP as an Administrator because of Viruses ... Log off from the admin account until ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Roaming Profiles & Local Permissions
    ... as Domain Power Users though a domain user can be in the local power users ... When the administrator logs in, ... but anyone other than administrator cannot install the program. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: GP with Permissions.
    ... with GP by adding to the Power users / Administrator and works fine. ... A Power User can install some kinds of software, ... You can make the users members of the local Power Users Group or Local ... Administrators using Restricted Groups Policy, ...
    (microsoft.public.windows.server.active_directory)
  • Re: Deny Permission for Internet Explorer
    ... If an administrator wanted stricter control of access to the computer's ... Users, Power Users, and Administrators. ... are used to assign permissions. ...
    (microsoft.public.win2000.security)
Loading