Why can limited account user change its type to administrator?

[Guest]

I created a limited account for my son, but he can change his account to
administrator privileged account from "User Account" menu in Control Panel.
Why can he change the type from one to another?

In safe mode, only created are "Administrator" and my own.

 

[Shenan Stanley]

I created a limited account for my son, but he can change his
account to administrator privileged account from "User Account"
menu in Control Panel. Why can he change the type from one to
another?

In safe mode, only created are "Administrator" and my own.

A limited account cannot change its type.
However - if you did not protect the password well and keep the machine from
being bootable from anything but the hard disk drive - many things can be
gotten around with simply reboots/utilities/logons..

 

[Leythos]

I created a limited account for my son, but he can change his account to
administrator privileged account from "User Account" menu in Control Panel.
Why can he change the type from one to another?

In safe mode, only created are "Administrator" and my own.

In safe mode, if there are only two accounts, your personal account and
Administrator, then you didn't create him an account.

When you create accounts they must have passwords or users can connect
as any account.

 

[Guest]

In safe mode, if there are only two accounts, your personal account and
Administrator, then you didn't create him an account.

When you create accounts they must have passwords or users can connect
as any account.

I did create the limited user account from Control Panel. At least, I
haven't seen a limited account in safe mode, which I created in this way.
This is confirmed by myself with another PC.

Is anyone able to explain why he, a limited user, has access to
administrator privileges? Is something wrong with setting of ownership of
folders? I did not find it wrong, though. Should I reinstall WinXP from
scratch? I want to know what caused this, because the current setting is
after the HD crash, real new one.

 

[Leythos]

I did create the limited user account from Control Panel. At least, I
haven't seen a limited account in safe mode, which I created in this way.
This is confirmed by myself with another PC.

If you created a limited account in Users, then it would still be a
limited account, so you've messed something up in the process.

Is anyone able to explain why he, a limited user, has access to
administrator privileges? Is something wrong with setting of ownership of
folders? I did not find it wrong, though. Should I reinstall WinXP from
scratch? I want to know what caused this, because the current setting is
after the HD crash, real new one.

You are leaving some details out:

Are you saying that the person has admin after a drive crash?

Right Click on My Computer, Select MANAGE, expand LOCAL USERS AND
GROUPS, select USERS, how many accounts do you see? List them all.

 

[Steven L Umbach]

It is not possible for a non administrator to add themselves to the
administrators group. You can use the command net localgroup administrators
to see what users are members of the local administrators group. Try
creating a new user and then have him logon to that user in front of you and
see if he can use that new account to add itself to the administrators
group. Possibly he gained administrator access without your knowledge on the
other user account which can bevery easy to do if a user has physical access
to the computer.

Steve

 

[Guest]

Can I ask? In safe mode, are all the administrator accounts shown? or not all
the administrator accounts are shown?

 

[Steven L Umbach]

I believe they are all shown. I use the command net localgroup
administrators to check membership. If you are using XP Home by default the
built in administrator account that can only be accessed in Safe Mode is
blank that many users take advantage of to add themselves to the
administrators group.

Steve

 

[Kerry Brown]

Can I ask? In safe mode, are all the administrator accounts shown? or
not all the administrator accounts are shown?

In safe mode the "Administrator" account is shown. If you haven't given this
account a password then this is how he is getting in.

You aren't listening to what everyone is telling you. You cannot 100% secure
a computer that someone has physical access to. Whatever you do can be
undone. You have a discipline/personal problem not a security problem. You
can make it very hard to change an account but if there is unsupervised
physical access then there is no way to stop a determined, knowledgable,
person. This is why secure computers are in locked rooms.