Strange folder permissions

[Guest]

I'm running Windows XP PRO with automatic updated and have just (4 days ago)
converted my user account from being a member of the administrators group to
being a member of the users group. I've created a new admin account for
occational use. Except for a couple of hickups with products that probably
were not design for running under non-admin accounts, all has been going
well. However, one of the products failed because of lacking access to a
folder/file in its own installation folder under Program Files. Logged on
with my, now limited, account I checked the security flags and found that I
was correctly not having access to the folder/file, BUT the options to allow
additional authority to myself were not dimmed out. So with this account I
could grant myself the required access and from then on everything worked
fine.

Since then I have discovered numerous Program Files folders that this
limited account has this type of access to, but there are also lots of them
without this additional access. What's happening here?

Using the Effective Permissions feature I've also found out that the limited
account SEEMS to have the following authorities to (I guess) everything in
the computer, including the Windows\system32 folder:

- Create Files / Write Data
- Create Folders / Append Data

Is this normal?

To summarize, I wish to know:

1) How come the limited user has authority to set security flags in some
folders/files, but not all?

2) Is it normal that a limited account has the Create security attributes
above to all folders and files?

3) Can I safely remove these capabilities from (at least) the WINDOWS and
Program Files folders and subfolders?

4) Are there any official recommendations with regards to folder and file
security settings?

Thanks in advance.

 

[Guest]

1) The Owner has the right to assign permissions even after being moved from
Administrators to a less privileged group. This includes those you created by
installs to C:\Program Files.

2) No

3) Safe procedure is to create a new User account for yourself, and then log
on as the new admin account and delete your original account - ownership
should now devolve to the Administrators group.

4) No, secure but tolerable settings settings depend on environment and
purpose.