User account control

[Guest]

I have set my account as the only one with administrator rights, but my son
has been able to create a new account with administrator rights despite the
fact that his won account has only limited rights and all accounts being
password protected. How can this be possible, and how can I prevent anyone
from creating new accounts with administrator rights? More important, how
can I prevent any unauthorised changes to the computer?

 

[Malke]

I have set my account as the only one with administrator rights, but
my son has been able to create a new account with administrator rights
despite the fact that his won account has only limited rights and all
accounts being
password protected. How can this be possible, and how can I prevent
anyone
from creating new accounts with administrator rights? More important,
how can I prevent any unauthorised changes to the computer?

Any computer running any operating system can be accessed by someone
with 1) physical access; 2) time; 3) skill; 4) tools. Your son
apparently has these things. There are a few things you can do to make
it a bit harder though:

1. Set a password in the BIOS that must be entered before booting the
operating system. Also set the Supervisor password in the BIOS so BIOS
Setup can't be entered without it.

2. From the BIOS, change the boot order to hard drive first.

3. Set strong passwords on all accounts, including the built-in
Administrator account.

4. If you leave your own account logged in, use the Windows Key + L to
lock the computer (and/or set the screensaver/power saving) when you
step away from the computer and require a password to resume.

5. Make other users Limited accounts in XP Home, regular user accounts
in XP Pro.

6. Set user permissions/restrictions:

a. If you have XP Pro, you can set user permissions/restrictions with
Group Policy (Start>Run>gpedit.msc [enter]) but be careful. Using the
Policy Editor can be tricksy. Questions about Group Policy should be
posted in its newsgroup: microsoft.public.windows.group_policy.

b. If you have XP Home, you can use MVP Doug Knox's Security Console or
the MS Shared Computer Toolkit. The Toolkit can also be used in XP Pro
and may be easier for a newbie than using Group Policies.

http://www.dougknox.com
http://www.microsoft.com/windowsxp/sharedaccess/default.mspx
microsoft.public.windows.sharedaccess - Toolkit newsgroup

Please understand that these are technical responses to what is
basically a non-technical problem and there are ways around all of
these precautions. This is a family/interpersonal issue that can't be
solved by technical means.

Malke

 

[Guest]

Very useful indeed. Many thanks. How do I set a password in the BIOS. I
have heard that messing about with the BIOS could be dangerous for a
technical moron like me. Besides, I'm running Windows on the new Apple iMac
with bootcamp. Will your techniques well equally well?

I have set my account as the only one with administrator rights, but
my son has been able to create a new account with administrator rights
despite the fact that his won account has only limited rights and all
accounts being
password protected. How can this be possible, and how can I prevent
anyone
from creating new accounts with administrator rights? More important,
how can I prevent any unauthorised changes to the computer?

Any computer running any operating system can be accessed by someone
with 1) physical access; 2) time; 3) skill; 4) tools. Your son
apparently has these things. There are a few things you can do to make
it a bit harder though:

1. Set a password in the BIOS that must be entered before booting the
operating system. Also set the Supervisor password in the BIOS so BIOS
Setup can't be entered without it.

2. From the BIOS, change the boot order to hard drive first.

3. Set strong passwords on all accounts, including the built-in
Administrator account.

4. If you leave your own account logged in, use the Windows Key + L to
lock the computer (and/or set the screensaver/power saving) when you
step away from the computer and require a password to resume.

5. Make other users Limited accounts in XP Home, regular user accounts
in XP Pro.

6. Set user permissions/restrictions:

a. If you have XP Pro, you can set user permissions/restrictions with
Group Policy (Start>Run>gpedit.msc [enter]) but be careful. Using the
Policy Editor can be tricksy. Questions about Group Policy should be
posted in its newsgroup: microsoft.public.windows.group_policy.

b. If you have XP Home, you can use MVP Doug Knox's Security Console or
the MS Shared Computer Toolkit. The Toolkit can also be used in XP Pro
and may be easier for a newbie than using Group Policies.

http://www.dougknox.com
http://www.microsoft.com/windowsxp/sharedaccess/default.mspx
microsoft.public.windows.sharedaccess - Toolkit newsgroup

Please understand that these are technical responses to what is
basically a non-technical problem and there are ways around all of
these precautions. This is a family/interpersonal issue that can't be
solved by technical means.

Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User

 

[Malke]

Very useful indeed. Many thanks. How do I set a password in the
BIOS. I have heard that messing about with the BIOS could be
dangerous for a
technical moron like me. Besides, I'm running Windows on the new
Apple iMac
with bootcamp. Will your techniques well equally well?

Normally to get into the BIOS you press a key (or keys in combination)
when first starting up. Since you have a Mac, refer to the manual or
look on Apple's tech support site. If you are unsure or uncomfortable,
have a professional computer person do it for you. Make sure you write
down any passwords and put them in a secure place.

Bootcamp does dual-booting, yes? If so, then when you are booted into
Windows you are running Windows. So applying Windows security is valid.
It doesn't matter what machine you're running the operating system on.

But the most important information that I gave you is this:

Please understand that these are technical responses to what is
basically a non-technical problem and there are ways around all of
these precautions. This is a family/interpersonal issue that can't be
solved by technical means.

Malke

 

[Guest]

I understand. Many thanks for your help.

I have set my account as the only one with administrator rights, but
my son has been able to create a new account with administrator rights
despite the fact that his won account has only limited rights and all
accounts being
password protected. How can this be possible, and how can I prevent
anyone
from creating new accounts with administrator rights? More important,
how can I prevent any unauthorised changes to the computer?

Any computer running any operating system can be accessed by someone
with 1) physical access; 2) time; 3) skill; 4) tools. Your son
apparently has these things. There are a few things you can do to make
it a bit harder though:

1. Set a password in the BIOS that must be entered before booting the
operating system. Also set the Supervisor password in the BIOS so BIOS
Setup can't be entered without it.

2. From the BIOS, change the boot order to hard drive first.

3. Set strong passwords on all accounts, including the built-in
Administrator account.

4. If you leave your own account logged in, use the Windows Key + L to
lock the computer (and/or set the screensaver/power saving) when you
step away from the computer and require a password to resume.

5. Make other users Limited accounts in XP Home, regular user accounts
in XP Pro.

6. Set user permissions/restrictions:

a. If you have XP Pro, you can set user permissions/restrictions with
Group Policy (Start>Run>gpedit.msc [enter]) but be careful. Using the
Policy Editor can be tricksy. Questions about Group Policy should be
posted in its newsgroup: microsoft.public.windows.group_policy.

b. If you have XP Home, you can use MVP Doug Knox's Security Console or
the MS Shared Computer Toolkit. The Toolkit can also be used in XP Pro
and may be easier for a newbie than using Group Policies.

http://www.dougknox.com
http://www.microsoft.com/windowsxp/sharedaccess/default.mspx
microsoft.public.windows.sharedaccess - Toolkit newsgroup

Please understand that these are technical responses to what is
basically a non-technical problem and there are ways around all of
these precautions. This is a family/interpersonal issue that can't be
solved by technical means.

Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User