Eliminating Administrator privileges from all users except "Administrator"

[windsurferLA]

Software - WinXP-pro w/ SR-2

When I set up my computer, I gave my user account administrative
privileges. I now realize that was a mistake as it increases the
vulnerability of my machine. By taking away administrative privileges
from my account, I make it more difficult for some nasty thing to modify
the programs on my computer because my account is no longer authorized
to modify programs.

Using TweakUI, I changed my sign in screen so that "Administrator" is
shown as one of the users. My plan was to then remove "administrator"
privileges from all the other users, but Windows said at least one
"user" have administrative privileges. I can get around this problem by
setting up another password protected "user" that does have
Administrative privileges, but the restriction does not seem logical.

What is rational behind insisting that at least one user have
administrative privileges? What can't be done by logging in as
"administrator" that can be done by User with administrative privileges?

 

[Rock]

Software - WinXP-pro w/ SR-2

When I set up my computer, I gave my user account administrative
privileges. I now realize that was a mistake as it increases the
vulnerability of my machine. By taking away administrative privileges from
my account, I make it more difficult for some nasty thing to modify the
programs on my computer because my account is no longer authorized to
modify programs.

Using TweakUI, I changed my sign in screen so that "Administrator" is
shown as one of the users. My plan was to then remove "administrator"
privileges from all the other users, but Windows said at least one "user"
have administrative privileges. I can get around this problem by setting
up another password protected "user" that does have Administrative
privileges, but the restriction does not seem logical.

What is rational behind insisting that at least one user have
administrative privileges? What can't be done by logging in as
"administrator" that can be done by User with administrative privileges?

You want to set aside the built in Administrator account as a fall back to
use if something damages the other account with administrator privileges.
Use this other account with administrator privileges for any activities that
need admin privileges. Create one or more limited user accounts and use one
of those for your normal activities.