Netorius77 said:
I have an XP-SP3 PC for the kids. I set it up with and administrator
account (me) and a kids account with limited privileges to try and prevent
the messing around with any system settings - well guess what they have
messed things up.
They asked me to help them load a program today and I discovered that my
the kids have a full privilege user account. When I saw that their account
had full privlages I changed it to limited privlages. I then tried to log
on as administrator to find that the administrator account no longer
exists.
My daughter (6) tells me she knows my password, so I surmise one of two
things has happened -
1. They deleted the admin account and left their limited user account
(unlikely)
2. The renamed the admin account and deleted their original account
(probably what I suspect)
I then tried to system restore but with limited privelages it appears that
that is not possible. I logged in in Safe mode but still can't change the
user setting. It also appears that there is only the one account.
Is there perhaps a registry setting (or some other way) to reset the user
access on this account?
Two-part answer:
A. I can't guess what your kids did. Log into any account that has
administrative privileges and make your changes from there. If it doesn't
appear that any user account has administrative privileges, log into the
built-in Administrator account (which cannot be deleted).
In XP Home, boot the computer into Safe Mode. Do this by repeatedly tapping
the F8 key as the computer is starting up. This will get you to the right
menu. Navigate using your Up arrow key; the mouse will not work here. Once
in Safe Mode, you will see the normally hidden Administrator account. The
default password is a blank.
In XP Pro/Media Center, you do not need to go into Safe Mode. At the Welcome
Screen, do Ctrl-Alt-Del twice to get the classic Windows logon box. Type in
"Administrator" and whatever password you assigned when you set up Windows.
If you reset the built-in Administrator account's password in Home or have
Pro and don't remember the password, use NTpasswd to change the built-in
Administrator account's password to a blank. Download the bootable CD .iso,
burn with third-party burning software (as an image, not as data), boot
with the media you created. You may need to change the boot order in the
BIOS or get a temporary boot order menu with a special keypress. NTpasswd
will run. Follow the instructions carefully.
http://home.eunet.no/~pnordahl/ntpasswd/
Then go to the User Accounts applet in Control Panel and set passwords that
you will remember and make other desired changes.
B. Security steps to take - Any computer running any operating system can be
accessed by someone with 1) physical access; 2) time; 3) skill; 4) tools.
There are a few things you can do to make it a bit harder though:
1. Set a password in the BIOS that must be entered before booting the
operating system. Also set the Supervisor password in the BIOS so BIOS
Setup can't be entered without it.
2. From the BIOS, change the boot order to hard drive first.
3. Set strong passwords on all accounts, including the built-in
Administrator account in XP (it is disabled by default in Vista).
4. If you leave your own account logged in, use the Windows Key + L to lock
the computer (and/or set the screensaver/power saving) when you step away
from the computer and require a password to resume.
5. Make other users Limited accounts in XP Home, regular user accounts in XP
Pro. All users should be on a Standard account in Vista with an
Administrator account only used for elevation purposes.
6. Set user permissions/restrictions:
If you have XP/Vista Home, you don't have the built-in ability to create
fine-grained limitations, so use either MVP Doug Knox's Security Console or
the MS SteadyState program to set the restrictions the way you want.
SteadyState supports Vista now.
http://www.dougknox.com
http://www.microsoft.com/windowsxp/sharedaccess/default.mspx
More on SteadyState:
http://aumha.net/viewtopic.php?t=27570
SteadyState support -
http://forums.microsoft.com/WindowsToolsandUtilities/ShowForum.aspx?ForumID=1660&SiteID=69
If you have XP Pro, Media Center, Vista Business or Vista Ultimate, you can
use Group Policy to set restrictions (gpedit.msc). Be very careful using
the Group Policy editor; it is completely possible to lock yourself out.
Questions about group policy should be posted here:
microsoft.public.windows.group_policy
Please understand that these security steps are technical responses to what
is basically a non-technical problem and there are ways around all of these
precautions. This is a family/interpersonal issue that can't be solved by
technical means.
Malke
