User Accounts versus Single User

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

I have recently acquired a laptop with Windows XP already installed.
Is the use of User Accounts mandatory or can XP be configured without having
to specifiy any User Accounts, as is the case with Windows 98?
 
Mark said:
I have recently acquired a laptop with Windows XP already installed.
Is the use of User Accounts mandatory or can XP be configured without
having to specifiy any User Accounts, as is the case with Windows 98?
Click to expand...

Well not like Windows 98. But the one user account that you use and if
it is set for Administrator settings, the other ones can be deleted. And
you can configure it to boot up without asking which user logs on
(whether or not there are other users or not).
 
Thanks Bill.

BillW50 said:
Well not like Windows 98. But the one user account that you use and if
it is set for Administrator settings, the other ones can be deleted. And
you can configure it to boot up without asking which user logs on
(whether or not there are other users or not).
Click to expand...
 
Mark said:
I have recently acquired a laptop with Windows XP already installed.
Is the use of User Accounts mandatory or can XP be configured without
having
to specifiy any User Accounts, as is the case with Windows 98?
Click to expand...

There is a built in Administrator account by that name. It cannot, nor
should you delete it. It is also not good practice to use this account for
day to day activities. Create at least one other account with admin level
privileges, and then as many limited user accounts as you need.

Assign a strong password to the built in Administrator account and set it
aside to be used if something damages the working admin account. Note when
another account with admin privileges is created the Administrator account
will "disappear" from the welcome screen. To login to it, for XP Pro at the
Welcome Screen do Ctrl-Alt-Del twice to bring up the classic login box,
enter Administrator as the user name and the assigned password. For XP Home
you have to start in Safe Mode and Administrator will appear on the Welcome
Screen.

The system can be setup to login automatically to a given account when the
computer is started. It's not a good security practice, but if you want to
here are two methods to accomplish it, one manually the other using TweakUI.

Auto Logon

1. Go to Start | Run and type in: control userpasswords2 | Ok.

2. On the Users tab, clear the Users Must Enter A User Name And Password To
Use This Computer check box and then click OK.

3. In the Automatically Log On dialog box that appears, type the user name
and password for the account you want to be logged on each time you start
your computer.

You can accomplish the same thing by:

Download and install TweakUI for XP and use its auto logon feature.
http://www.microsoft.com/windowsxp/pro/downloads/powertoys.asp

Lastly you can add the Dialog box that comes up when running control
userpasswords2 to the Control Panel with the following tweak:

Add Control User Passwords2 to the Control Panel (Line 1)
http://www.kellys-korner-xp.com/xp_tweaks.htm

There is also a Guest account which is created by default. Unless the
system is on a network it is recommended security practice to disable the
Guest account.

Here is a link with information on how to create an account.

HOW TO Create and Configure User Accounts in Windows XP
http://support.microsoft.com/?id=279783
 
Rock said:
There is a built in Administrator account by that name. It cannot,
nor should you delete it. It is also not good practice to use this
account for day to day activities. Create at least one other account
with admin level privileges, and then as many limited user accounts
as you need.
Click to expand...

[clip]

Well yes you can delete the Administrator (user name) account and for
security purposes, it should be deleted. The rule is you can't delete
all administrator privileges. You must have at least one user with
administrator privileges. And that user name doesn't have to be called
Administrator either.

As when hackers try to access an unknown computer. And they don't know
any user names to use to access that computer. So what is the first user
name account are they going to try to hack into? That is right, they are
going to try to access the user named Administrator.

See unlike Rock, I have no user named Administrator on any of my
systems. So a hacker could try to hack into that user account here from
now until the end of time... and they will never get in. Because that
account just doesn't exists here. Unlike 99.999% of the other computers
out there.
 
BillW50 said:
Rock said:
There is a built in Administrator account by that name. It cannot,
nor should you delete it. It is also not good practice to use this
account for day to day activities. Create at least one other account
with admin level privileges, and then as many limited user accounts
as you need.
Click to expand...

[clip]

Well yes you can delete the Administrator (user name) account and for
security purposes, it should be deleted. The rule is you can't delete
all administrator privileges. You must have at least one user with
administrator privileges. And that user name doesn't have to be called
Administrator either.

As when hackers try to access an unknown computer. And they don't know
any user names to use to access that computer. So what is the first user
name account are they going to try to hack into? That is right, they are
going to try to access the user named Administrator.

See unlike Rock, I have no user named Administrator on any of my
systems. So a hacker could try to hack into that user account here from
now until the end of time... and they will never get in. Because that
account just doesn't exists here. Unlike 99.999% of the other computers
out there.
Click to expand...

This is incorrect. You cannot delete the built-in Administrator account,
nor should you even if you could. If you like to rename it that's fine,
but on a properly protected computer unnecessary. For the OP, here is a
brief explanation of the XP account hierarchy:

XP is a multi-user operating system, no matter if only one person is
using it. In all multi-user operating systems - NT, Win2k, XP, Unix,
Linux, Mac OSX - there is the one built-in account that is "god" on the
system. In Windows terminology, that is "Administrator". In the *nix
world, it is "root". This is a necessary account and is not normally
used in everyday work. You cannot delete the built-in Administrator
account nor would you ever want to.

Here is the explanation of what you have:

My Computer - represents your entire computer, showing drives and shared
folders. Shared Folders are folders where you can put files you wish to
share with other users on the system. You don't need to use these
folders if you don't want to, but leave them alone!

[some name] C:\ - your first hard drive, usually the system drive.

Document and Settings - The "container" for all user settings. Each user
will have [username] Documents, Music, Videos, My Pictures.

Administrator - Built-in account - Leave alone! Do not use! Do not worry
about it!

All Users - Section where items common to all users go. In a multi-user
operating system, users have separate accounts. This is the place where
if you want to share files with all the other users on the system you
would put those files. You don't ever have to use those folders but they
need to be there. This is where programs you install that are meant to
be installed for all users put settings. All the "Shared Documents" type
of folders you see at the root of C:\ are shortcuts to the shared
folders in here. Leave them alone!

Default Users - This is the template from which new user accounts are
made. You will never put anything in any of those folders but they are
needed to create new users. In Linux we use "skel" ("skeleton" - get
it?). In Windows, the less-colorful term "Default User" is used. Leave
it alone!

[OEM] Administrator or Owner - This is the generic user created by the
OEM when installing the operating system. After all, the OEM doesn't
know who is going to buy the computer. If you aren't using this OEM user
account, you can delete it from the User Accounts applet in Control
Panel. It is not the same account as "Administrator". If you don't have
an OEM machine (HP, Dell, etc.) you won't have this account.


Malke
 
BillW50 said:
Rock said:
There is a built in Administrator account by that name. It cannot,
nor should you delete it. It is also not good practice to use this
account for day to day activities. Create at least one other account
with admin level privileges, and then as many limited user accounts
as you need.
Click to expand...

[clip]

Well yes you can delete the Administrator (user name) account and for
security purposes, it should be deleted. The rule is you can't delete all
administrator privileges. You must have at least one user with
administrator privileges. And that user name doesn't have to be called
Administrator either.

As when hackers try to access an unknown computer. And they don't know any
user names to use to access that computer. So what is the first user name
account are they going to try to hack into? That is right, they are going
to try to access the user named Administrator.

See unlike Rock, I have no user named Administrator on any of my systems.
So a hacker could try to hack into that user account here from now until
the end of time... and they will never get in. Because that account just
doesn't exists here. Unlike 99.999% of the other computers out there.
Click to expand...


I have no idea what you are talking about. The system prevents you from
deleting the built in Administrator account in XP, nor should you.
 
Rock said:
I have no idea what you are talking about. The system prevents you
from deleting the built in Administrator account in XP, nor should
you.
Click to expand...

Right Rock! Whatever you say!

"Condemnation without investigation is the height of ignorance." ~
Albert Einstein

"People who say it cannot be done should not interrupt the people who
are doing it." -- Anonymous
 
Right Rock! Whatever you say!

"Condemnation without investigation is the height of ignorance." ~ Albert
Einstein

"People who say it cannot be done should not interrupt the people who are
doing it." -- Anonymous
Click to expand...

So how did you delete it Bill?

Also I don't understand why you say it should be deleted for security
purposes. There should be at least two accounts on the system with Admin
privileges. Renaming the Administrator account is good practice and as well
as assigning a strong password, but why delete it?
 
Rock said:
So how did you delete it Bill?

Also I don't understand why you say it should be deleted for security
purposes. There should be at least two accounts on the system with
Admin privileges. Renaming the Administrator account is good
practice and as well as assigning a strong password, but why delete
it?
Click to expand...

Correct! For simpletons, renaming works best. And yes you should add a
strong password. I don't know why you suggest having at least two
administrator accounts? Unless you believe one of them may get trashed
one day.

OTOH, Malke suggests: "Administrator - Built-in account - Leave alone!
Do not use! Do not worry about it!"

Well that just leaves your system wide open. As the default is no
password. Thus anybody can have full access to your computer. I don't
recommend this one bit and I think it is foolish.
 
BillW50 said:
Correct! For simpletons, renaming works best. And yes you should add a
strong password. I don't know why you suggest having at least two
administrator accounts? Unless you believe one of them may get trashed one
day.

OTOH, Malke suggests: "Administrator - Built-in account - Leave alone! Do
not use! Do not worry about it!"

Well that just leaves your system wide open. As the default is no
password. Thus anybody can have full access to your computer. I don't
recommend this one bit and I think it is foolish.
Click to expand...


As Pegasus puts it, do you have only one set of keys for your car? You hit
it on the head, with only one admin level account if that messes up, you
could be in big trouble. It's not uncommon for us to see posts in here were
that is the problem.

Plus I don't see where there is any more security problem with having two
admin accounts rather than one. You haven't explained why it is a security
problem to have the Administrator account.

Also you haven't explained how to delete it. I'm still listening.
 
Rock said:
As Pegasus puts it, do you have only one set of keys for your car? You
hit it on the head, with only one admin level account if that
messes up, you could be in big trouble. It's not uncommon for us to
see posts in here were that is the problem.
Click to expand...

Okay, I rather use BartPE and ERUNT myself. Not only for this but
backing up and protecting my registry.
Plus I don't see where there is any more security problem with having
two admin accounts rather than one. You haven't explained why it is
a security problem to have the Administrator account.
Click to expand...

Well having more than one is okay, I have no problems there. The problem
I have is keeping the user name as Administrator. Rename it, delete it,
or something. And add a secure password.
Also you haven't explained how to delete it. I'm still listening.
Click to expand...

I seem to recall it was very easy. I believe it worked like this:

While on the Administrator account, give one user (or make a new one)
with Administrator privileges. Logoff and then logon on this new
administrator account. Now you are free to delete the original one.
Simple, eh?

Another way is to hack the registry:
Windows NT/2K/XP/2K3 manual removal of the Administrator account
http://www.kuro5hin.org/story/2004/7/4/7570/05276
 
Correct! For simpletons, renaming works best. And yes you should add a
strong password. I don't know why you suggest having at least two
administrator accounts? Unless you believe one of them may get trashed one
day.

OTOH, Malke suggests: "Administrator - Built-in account - Leave alone! Do
not use! Do not worry about it!"

Well that just leaves your system wide open. As the default is no
password. Thus anybody can have full access to your computer. I don't
recommend this one bit and I think it is foolish.
Click to expand...

The default in XP Home is no password. In XP Pro at the time of
installation the user is prompted to set a password. The user has to choose
not to set one.

On another note, assuming for this discussion that one manages to delete the
built in Administrator account, how do you then enter the recovery console,
since that uses the built in Administrator account? Yes I know you can edit
the registry so that no password is needed to access the recovery console,
but still it's accessed through the built in Administrator account, so what
happens when that's gone?
 
Rock said:
As Pegasus puts it, do you have only one set of keys for your car? You
hit it on the head, with only one admin level account if that
messes up, you could be in big trouble. It's not uncommon for us to
see posts in here were that is the problem.
Click to expand...

Okay, I rather use BartPE and ERUNT myself. Not only for this but
backing up and protecting my registry.
Plus I don't see where there is any more security problem with having
two admin accounts rather than one. You haven't explained why it is
a security problem to have the Administrator account.
Click to expand...

Well having more than one is okay, I have no problems there. The problem
I have is keeping the user name as Administrator. Rename it, delete it,
or something. And add a secure password.
Also you haven't explained how to delete it. I'm still listening.
Click to expand...

I seem to recall it was very easy. I believe it worked like this:

While on the Administrator account, give one user (or make a new one)
with Administrator privileges. Logoff and then logon on this new
administrator account. Now you are free to delete the original one.
Simple, eh?

Another way is to hack the registry:
Windows NT/2K/XP/2K3 manual removal of the Administrator account
http://www.kuro5hin.org/story/2004/7/4/7570/05276

AJR said:
Rock - you are corrrect and you are wasting your time!
Click to expand...

Says who AJR? I guess the saying that you can't teach an old dog new
tricks is true, eh AJR?
 
"Rock" wrote
Click to expand...

Bill wrote
Okay, I rather use BartPE and ERUNT myself. Not only for this but
backing up and protecting my registry.
Click to expand...

Those are good tools, but not relevant to the point. The purpose of two
admin accounts is to provide a simple fallback so one doesn't have to use a
utility and extra time to get things working (and that's assuming one could
fix it). This is protection for the average (and smart) user. Bring out
the big guns when needed, sure, but why do so if other simpler measures will
suffice?

Rock wrote
Bill wrote
Well having more than one is okay, I have no problems there. The problem
I have is keeping the user name as Administrator. Rename it, delete it,
or something. And add a secure password.
Click to expand...

Assign a strong password and rename it - that sounds familiar.

Bill, in your original reply to the OP you wrote, "Well yes you can delete
the Administrator (user name) account and for
security purposes, it should be deleted." Now are you saying it's ok to
have more than one admin account and implying the Adminstrator account is ok
too, but the problem is with the name? So which is it?

Should it be deleted for security purposes, as you originally stated, and if
so what is the specific security purpose?

Or is it that your security concerns can truly be satisified by assigning a
strong password and renaming the account, as a simpleton might do?

Rock wrote
Bill wrote
I seem to recall it was very easy. I believe it worked like this:

While on the Administrator account, give one user (or make a new one)
with Administrator privileges. Logoff and then logon on this new
administrator account. Now you are free to delete the original one.
Simple, eh?
Click to expand...

Have you actually tried this, Bill? The Administrator account doesn't show
up by default in the User Accounts applet in Control Panel. In XP Pro in
normal mode one has to go to a command prompt and run control
userpasswords2. (I'm not sure how you would get to it in XP Home. I'm
thinking start in Safe Mode, login to the other admin account, and do
control userpasswords2).

Highlight the Administrator account, click on "Remove" and XP throws an
error, "The user <Computer Name><Administrator> could not be removed". It
doesn't matter if the account was renamed, either. XP won't delete that
account.

I guess not so simple?

Bill wrote
Another way is to hack the registry:
Windows NT/2K/XP/2K3 manual removal of the Administrator account
http://www.kuro5hin.org/story/2004/7/4/7570/05276
Click to expand...

Yes, I was aware that you can mess with it by extraordinary means. Have you
actually read that article? Here is a quote from it, near the beginning of
the article:

"DISCLAIMER

"Before I begin, I am obliged to point out that editing the Registry in
Windows is risky at the best of times, and that following the steps in this
article is downright nuts. ... Even if you follow these steps perfectly you
could still render your system mangled by unintentionally removing all
administrative accounts. ..."

[Note: The last statement is the exact thing one wants to avoid by having
two admin level accounts. If the only admin level account becomes
corrupted, might that not be the equivalent of removing all administrative
accounts, in effect "mangled"? ]

Why did the author work out this process, you ask? They write:

"I ran into a situation several years or ago where I was presented with the
problem that for a truly high-security machine -- where security trumps
other concerns (like always being able to access a machine no-matter-what,
etc)-- that it was necessary to be able to either remove or disable the
builtin Administrator account in NT. This is a problem because NT doesn't
provide you with any way to do this."

[Note: the last sentence in this paragraph is in bold font for emphasis. (I
wonder why, eh?) Since I am posting in text mode the bold doesn't show.]

Did the author actually delete the Administrator account, you ask? No.

"I decided that the easiest way to achieve my purpose was not to try and
delete the Administrator account, but to simply remove it from the local
Administrators group (thus removing its privileges). "

And that's the process the article goes on to discuss in complicated detail.

Do you still maintain that one can and should delete the Administrator
account for security purposes? Is this something the average user or even
not so average user should do for system security?

Bill, the point isn't to get into an argument about who is right, the point
is to provide the OP with the best info, wouldn't you agree?
 
[snip]
Bill wrote

Those are good tools, but not relevant to the point. The purpose of
two admin accounts is to provide a simple fallback so one doesn't
have to use a utility and extra time to get things working (and
that's assuming one could fix it). This is protection for the
average (and smart) user. Bring out the big guns when needed, sure,
but why do so if other simpler measures will suffice?
Click to expand...

Because you should have these tools to get you out of trouble anyway.
And if you single admin account gets trashed these tools can fix it for
you. And I personally never had a corrupt user account yet. Lucky maybe.

[snip]
Bill, in your original reply to the OP you wrote, "Well yes you can
delete the Administrator (user name) account and for
security purposes, it should be deleted." Now are you saying it's ok
to have more than one admin account and implying the Adminstrator
account is ok too, but the problem is with the name? So which is it?

Should it be deleted for security purposes, as you originally stated,
and if so what is the specific security purpose?

Or is it that your security concerns can truly be satisified by
assigning a strong password and renaming the account, as a simpleton
might do?
Click to expand...

I don't think you are following me. I don't believe having a user named
Administrator on any Windows machine is ever a good idea. Rename it,
delete it, or whatever. As a hacker needs to know two things to hack
into your computer. And knowing that most people have a user name
Administrator makes it much easier for them. Although if there is no
such user, it makes it that much tougher for them. As now they have to
find out a valid user name. Thus for security purposes, I highly
recommend this. And many Windows XP Home users has a blank password for
the Admin account anyway. Not good at all.
Rock wrote

Bill wrote

Have you actually tried this, Bill? The Administrator account
doesn't show up by default in the User Accounts applet in Control
Panel. In XP Pro in normal mode one has to go to a command prompt
and run control userpasswords2. (I'm not sure how you would get to
it in XP Home. I'm thinking start in Safe Mode, login to the other
admin account, and do control userpasswords2).

Highlight the Administrator account, click on "Remove" and XP throws
an error, "The user <Computer Name><Administrator> could not be
removed". It doesn't matter if the account was renamed, either. XP
won't delete that account.

I guess not so simple?
Click to expand...

Yes I have done it before. And so did Navycross...

http://www.softwaretipsandtricks.com/forum/70041-post7.html

Bill wrote

Yes, I was aware that you can mess with it by extraordinary means.
Have you actually read that article? Here is a quote from it, near
the beginning of the article:

"DISCLAIMER

"Before I begin, I am obliged to point out that editing the Registry
in Windows is risky at the best of times, and that following the
steps in this article is downright nuts. ... Even if you follow these
steps perfectly you could still render your system mangled by
unintentionally removing all administrative accounts. ..."
Click to expand...

And you believe all Admin accounts can't be deleted. Imagine that!

[snip]
[Note: the last sentence in this paragraph is in bold font for
emphasis. (I wonder why, eh?) Since I am posting in text mode the
bold doesn't show.]
Click to expand...

Works here! Just use *bold* (by adding asterisks) and OE-QuoteFix
displays no asterisks but the text in between as bold text. This is the
way we always have done it when everything only came in plain text.
Did the author actually delete the Administrator account, you ask? No.
"I decided that the easiest way to achieve my purpose was not to try
and delete the Administrator account, but to simply remove it from
the local Administrators group (thus removing its privileges). "

And that's the process the article goes on to discuss in complicated
detail.
Do you still maintain that one can and should delete the Administrator
account for security purposes? Is this something the average user
or even not so average user should do for system security?
Click to expand...

I have and continue to maintain that the user name Administrator is a
security risk. Rename it, delete it, or whatever you want.
Bill, the point isn't to get into an argument about who is right, the
point is to provide the OP with the best info, wouldn't you agree?
Click to expand...

Yes very!
 
Thank you all for this information. It is such a pain to go into Safe Mode
every time I want to see the Administrator account.

Why does it matter how strong the passwords are? There exists a boot disk
that takes you to something called SAM, where you can delete or change the
passwords. You have to have access to the computer to use this, but I'm sure
someone has figured out how to do it online.

If, like me, you have a problem with people changing your passwords, a
company named Spotmau makes a program that will allow you to delete or change
Administrator's password or any other with a GUI interface. You boot from the
CD. You can download it or have them send you the disk. It has a lot of other
features too. It's at spotmau.com.

When I was in SAM, I noticed that a couple of passwords were "locked." Would
this protect a password from being changed? If so, how do you do it?

Thank you.
 
Thank you all for this information. It is such a pain to go into Safe Mode
every time I want to see the Administrator account.

Why does it matter how strong the passwords are? There exists a boot disk
that takes you to something called SAM, where you can delete or change the
passwords. You have to have access to the computer to use this, but I'm
sure
someone has figured out how to do it online.

If, like me, you have a problem with people changing your passwords, a
company named Spotmau makes a program that will allow you to delete or
change
Administrator's password or any other with a GUI interface. You boot from
the
CD. You can download it or have them send you the disk. It has a lot of
other
features too. It's at spotmau.com.

When I was in SAM, I noticed that a couple of passwords were "locked."
Would
this protect a password from being changed? If so, how do you do it?
Click to expand...


I'm confused a bit here Elizabeth. Are you the original poster?

To access the built in Administrator account in XP Home requires Safe Mode.
XP Pro does not. It's accessible from normal mode there.

Passwords need to be strong so that a hacker using standard tools, can't
connect and determine what the passwords are. See this link.

http://www.microsoft.com/protect/yourself/password/create.mspx

http://www.microsoft.com/protect/yourself/password/checker.mspx

Sorry I'm not sure what you are talking about with this boot disk and SAM.
 
Back
Top