Administrator folder in Windows Explorer

[Smirnoff]

XP Pro, SP3

Talk about not being able to see the wood for the trees!

I am the sole user of my computer and have JUST noticed that I now have
an Administrator folder in Win. Explorer, listed under Documents and
Settings, along with All Users and my normal username (with admin.
privileges) account.

The bits I THINK I know:

Having done some checking, I believe that the Admin. folder does not
show until you actually log in to it and a user profile is created. The
folder shows it was created some time in August, oh boy. I seem to
remember logging in to it just to see what options were available.

The bits I definitely DON'T know:

In Win. Explorer, I have "Do not show hidden files and folders" and
"Hide protected operating system files" checked

I was therefore a bit surprised that when I clicked on the Admin.
folder, it showed the sub-folders (admin. documents, desktop,
favourites, programs etc.). I would have thought that, as I am now
logging in with my usual username, the Admin. folder would have shown a
warning of some kind about being protected or at least requiring a
password. Why doesn't this happen?

Just out of interest, I know my usual account already has admin.
privileges but as far as I know, this doesn't include such things as
taking ownership of files. Could this option be accessed through the
Admin folder? Probably not.

Presumably, all I would have to do is right-click the
folder>Properties>check "Hidden" and it's gone (unless I change the View
options). However, I am intrigued as to why the Admin. folder appears at
all, when you are logging in as another user.

 

[Malke]

XP Pro, SP3

I am the sole user of my computer and have JUST noticed that I now have
an Administrator folder in Win. Explorer, listed under Documents and
Settings, along with All Users and my normal username (with admin.
privileges) account.

(snip all the bits that are really off base anyway)

Yes, of course you do. That is the built-in Administrator account. See below
for an explanation of the user profiles you are seeing:

XP is a multi-user operating system, no matter if only one person is using
it. In all multi-user operating systems - NT, Win2k, XP, Vista, Unix,
Linux, Mac OSX - there is the one built-in account that is "god" on the
system. In Windows terminology, that is "Administrator". In the *nix world,
it is "root". This is a necessary account and is not normally used in
everyday work. You cannot delete the built-in Administrator account nor
would you ever want to.

Documents and Settings - The "container" for all user settings. Each user
will have [username] My Documents, My Music, My Videos, My Pictures.

The All Users profile contains Shared Folders and settings common to all
users on the system. It doesn't matter if only one regular user exists
(you); this profile needs to be there. You don't need to use the Shared
Folders if you don't want to, but leave them alone!

Default User - This is the template from which new user accounts are made.
You will never put anything in any of those folders but they are needed to
create new users. In Linux we use "skel" ("skeleton" - get it?). In Windows
XP, the less-colorful term "Default User" is used. Leave it alone!

Administrator - Built-in account - Leave alone! Do not use! Do not worry
about it! In XP, the built-in Administrator account is only visible in
Documents and Settings if you have XP Pro/Media Center. In XP Home, it can
only be accessed in Safe Mode.

I hope this has clarified things for you.

Malke

 

[Smirnoff]

XP Pro, SP3

I am the sole user of my computer and have JUST noticed that I now
have
an Administrator folder in Win. Explorer, listed under Documents and
Settings, along with All Users and my normal username (with admin.
privileges) account.

(snip all the bits that are really off base anyway)

Yes, of course you do. That is the built-in Administrator account. See
below
for an explanation of the user profiles you are seeing:

XP is a multi-user operating system, no matter if only one person is
using
it. In all multi-user operating systems - NT, Win2k, XP, Vista, Unix,
Linux, Mac OSX - there is the one built-in account that is "god" on
the
system. In Windows terminology, that is "Administrator". In the *nix
world,
it is "root". This is a necessary account and is not normally used in
everyday work. You cannot delete the built-in Administrator account
nor
would you ever want to.

Documents and Settings - The "container" for all user settings. Each
user
will have [username] My Documents, My Music, My Videos, My Pictures.

The All Users profile contains Shared Folders and settings common to
all
users on the system. It doesn't matter if only one regular user exists
(you); this profile needs to be there. You don't need to use the
Shared
Folders if you don't want to, but leave them alone!

Default User - This is the template from which new user accounts are
made.
You will never put anything in any of those folders but they are
needed to
create new users. In Linux we use "skel" ("skeleton" - get it?). In
Windows
XP, the less-colorful term "Default User" is used. Leave it alone!

Administrator - Built-in account - Leave alone! Do not use! Do not
worry
about it! In XP, the built-in Administrator account is only visible in
Documents and Settings if you have XP Pro/Media Center. In XP Home, it
can
only be accessed in Safe Mode.

I hope this has clarified things for you.

Malke

Thanks for your reply. I DO understand the different User accounts.

I realise that the Admin folder is visible in XP Pro but it seems only
after it has been logged into and a user profile has been created.
That's why I don't remember seeing it until after I logged into it in
August.

Perhaps I posed the question in the wrong way.

Say I created another user account. A limited, non-admin account
(Guest). I know that a guest can only change their password and picture
(avatar), but would they have access to Win. Explorer and would they see
the Admin. folder?

Or, is it only users with admin. privileges that can access Win.
Explorer?

 

[Malke]

Thanks for your reply. I DO understand the different User accounts.

I realise that the Admin folder is visible in XP Pro but it seems only
after it has been logged into and a user profile has been created.
That's why I don't remember seeing it until after I logged into it in
August.

Perhaps I posed the question in the wrong way.

Say I created another user account. A limited, non-admin account
(Guest). I know that a guest can only change their password and picture
(avatar), but would they have access to Win. Explorer and would they see
the Admin. folder?

Or, is it only users with admin. privileges that can access Win.
Explorer?

The built-in Administrator is created when the operating system is first
installed. It is always visible in XP Pro/MCE's Explorer whether you log
into it or not. If you don't remember seeing it, you probably just didn't
notice it. Or perhaps it isn't visible unless you show Hidden Files. You
can test this for yourself.

All users can access Explorer. Explorer.exe is the Windows graphical user
interface.

The Guest account is not a regular user (Standard in XP Pro/MCE, Limited in
XP Home). It is a System account that doesn't have the same permissions as
a regular account. For more information about Guest - and why not to use it
- see below.
*****
Do not use the Guest account you see in the User Accounts applet in Control
Panel. The Guest account is a special system account, not one meant for
when you are feeling hospitable. It is disabled by default in Windows XP,
Vista, Linux, Unix, and OS X for a reason.

From TechNet:

"The Guest account is intended for users who require temporary access to the
system. However, if this account is enabled, a security risk may exist
because an unauthorized user could gain anonymous access to the system
through this account."

http://technet.microsoft.com/en-us/library/bb418978(TechNet.10).aspx

So if you enabled Guest, disable it now and create a Standard/Limited
(Vista, XP Pro/XP Home) for your visitors. Call the new user account
something like "Visitor".
*****

If you wish to prevent Standard/Limited users from accessing the
Administrator account, create a password for it and they will be denied
access.

I don't have any Standard users set up on my XP Pro machines to test for
you, but you can easily answer your question yourself:

A. Create a password for the built-in Administrator account by either
logging into it or from another user account with administrative privileges
thusly:

1. Click Start, and then click Run.
2. In the Open box, type "mmc" (without the quotation marks), and then click
OK to start MMC.
3. Start the Local Users and Groups snap-in.
4. Under Console Root, expand "Local Users and Groups", and then click
Users.
5. In the right pane, right-click Administrator, and then click Set
Password.
6. Click Proceed in the message box that appears.
7. Type and confirm the new password in the appropriate boxes, and then
click OK.

B. Create a Standard user (not Guest) and log into that account. See if you
can access the Administrator account's profile using Windows Explorer.

Malke

 

[Smirnoff]

The built-in Administrator is created when the operating system is
first
installed. It is always visible in XP Pro/MCE's Explorer whether you
log
into it or not. If you don't remember seeing it, you probably just
didn't
notice it. Or perhaps it isn't visible unless you show Hidden Files.
You
can test this for yourself.

All users can access Explorer. Explorer.exe is the Windows graphical
user
interface.

The Guest account is not a regular user (Standard in XP Pro/MCE,
Limited in
XP Home). It is a System account that doesn't have the same
permissions as
a regular account. For more information about Guest - and why not to
use it
- see below.
*****
Do not use the Guest account you see in the User Accounts applet in
Control
Panel. The Guest account is a special system account, not one meant
for
when you are feeling hospitable. It is disabled by default in Windows
XP,
Vista, Linux, Unix, and OS X for a reason.

From TechNet:

"The Guest account is intended for users who require temporary access
to the
system. However, if this account is enabled, a security risk may exist
because an unauthorized user could gain anonymous access to the system
through this account."

http://technet.microsoft.com/en-us/library/bb418978(TechNet.10).aspx

So if you enabled Guest, disable it now and create a Standard/Limited
(Vista, XP Pro/XP Home) for your visitors. Call the new user account
something like "Visitor".
*****

If you wish to prevent Standard/Limited users from accessing the
Administrator account, create a password for it and they will be
denied
access.

I don't have any Standard users set up on my XP Pro machines to test
for
you, but you can easily answer your question yourself:

A. Create a password for the built-in Administrator account by either
logging into it or from another user account with administrative
privileges
thusly:

1. Click Start, and then click Run.
2. In the Open box, type "mmc" (without the quotation marks), and then
click
OK to start MMC.
3. Start the Local Users and Groups snap-in.
4. Under Console Root, expand "Local Users and Groups", and then click
Users.
5. In the right pane, right-click Administrator, and then click Set
Password.
6. Click Proceed in the message box that appears.
7. Type and confirm the new password in the appropriate boxes, and
then
click OK.

B. Create a Standard user (not Guest) and log into that account. See
if you
can access the Administrator account's profile using Windows Explorer.

Malke

A very much more comprehensive answer. I get it now.

Thanks very much.