"cquirke (MVP Win9x)" wrote in message
Yes I hear you! A royal pita. <g>
I logged on as Administrator only to find all my ascetic Desktop & Folder
settings from Woody were not there ..luckily as I went in further I could
see all my special Services, Performance, etc settings I made were still in
tact. Just not sure how far I wanted or should go with setting it up
double, but what's perplexing is that I want all the same programs, and,
well - - - everything visible in Admin as I have in woody! Heck it's all me
anyway!
I know; one resents having an identity-based security model suited to
the workplace foisted on one as a single user.
Some settings will be system-wide, held in the system registry hives
that live in the OS subtree. These correspond to HKLM, and aliases.
Others will be per-user, held in the NTUSER.* within the account's
subtree on the local PC, or as a 'roving profile" on a server.
Some branches of the registry show a fusion of these, so you don't
really know what's going on (e.g. HKCR in XP).
Some global settings are set at the system level but others are set
via the AllUsers profile. New user accounts are built from the
Default User, but some stuff apparently comes from somewhere else.
For now I reset the basics and log'd out of admin and back into woody, but I
have a good mind to delete or just forget the other users and just always
log on as admin - this may not be good for normal folk, but being the sole
user and behind a router and firewall - - why not - it's no different than
W9x is once secured and I don't want to play with dual personalities.
That's what I've retreated to doing. It's prolly not best practice,
if XP's design expects user account rights to play a meaningful role
in risk management, but it seems too impractical to do anything else
unless one is prepared to accept a lower standard of overall control.
When it comes to the UI, I populate AllUsers desktop and Start Menu
only, stripping the per-user equivalents bare. For SendTo and
QuickLaunch, I populate each account's locations by hand - because you
don't know in advance what accounts will exist, it's hard to automate.
awful duhfaults is right! Thank goodness it has the ClassicView etc so that
I can have it back looking like a real OS instead of a candy striped
whipcreamed chocolate sprinkles desktop screen and buttons!
The killers for me are:
- hiding system files, extensions, full paths
- duhfault IE cache
- duhfault shell folder locations
- certain per-user risks e.g. NoDriveTypeAutoRun
Yes I saw that article too, but that's does not help my mindset of what I
want to do. Coming from a long time 9x I'm still set in my ways
The UI's against one, and there are "can't get to there from here"
issues. The new account prototype is the key here; if you can preset
that the way you want it, you'd have a lot less reason to shun
multiple accounts. Then all you'd need is a way to lockstep the
application of settings, e.g. fixing NoDriveTypeAutoRun after some
dumb game has reverted it back to 95 00 00 00
<vbg> heh, I know exactly what you mean, after you get things set up like
you want and go to change one setting back to try it out, plonk, you're back
to the frilliness screen again.
It's not just the look of it, it's the risk - how can users assess
risk and thus apply "safe hex" if they can't see what things are?
I found out if you set all the Services settings
Those are system-level, AFAIK... aren't they? I'm pretty sure most if
not all of them run from one of the "system" accounts.
What would be neat is a Regedit view that lets you bang settings
across user accounts (both existing and New prototype) under
checkbox control, e.g...
Apply these changes to:
[x] Administrator
[x] Valued Customer
[x] Freddy
[x[ Sophie
[_] Guest
[x] New account prototype
Until that day, I avoid multiple accounts and fiddling with
per-account user rights. The benefits aren't worth it IMO.
Agreed, and all this is not needed for a Single user who wants to use XPro.
I know - though in fairness, that's really what makes Pro "pro"; the
ability to apply stronger security on a per-user basis. When the same
unavoidable model is applied in Home, that's when I get annoyed.
I think I will also let it auto logon instead of typing a pass everytime I
reboot! In essence, once you lock the open doors on it down, and you're
sitting behind a Firewall and Router, why not let it autolog on ?
You need to download and use the TweakUI power toy for XP. This lets
you set a password for your account (which is required if you want
Tasks to run) and then have the system autologin using that password.
It also gives you a "front door" to relocate shell folders, which is a
must if you want to keep data and bloated wads of music, pics and
videos off C: (on some other HD volume, IOW).
Heck, for that matter why not just Log on as Admin and keep one
account..
We are supposed to pretend to be a(n un)trusted employee, so that when
malware gains control during our sessions, it will be limited to the
rights you allowed yourself. Makes as much sense to me as leaving the
house front door open and needing a key card to enter particular rooms
in the house, but as you say - makes perfect sense in an office block.
When I started with XP, I really wanted to "do things the right way"
and learn the XP way of doing things - but while each version of NT is
more complete than the one before, there are still too many things one
needs to be able to do that don't seem possible.
-------------------- ----- ---- --- -- - - - -
Tip Of The Day:
To disable the 'Tip of the Day' feature...
