Administrator's delete password issue

[Tim]

Hi there,

I set up a Vista with a Administrator, password protected account and then
set up a Standard user account but at the moment I find that the Standard
user account can delete the Administrators password and account how can that
be?

What I would like to do is have an Administrators account and a User account
with Administrator privileges but I don't want the User account to be able
to Delete the Administrators account or password.

Is this possible with Vista Home Premium?

Many thanks, Tim.

 

[Tim]

Hello Tim,
I could have said "impossible" to question #1, and "no" to #2. But that
won't make you understand any better than before you asked. So, please
read the followings :

WHAT IS A STANDARD USER ACCOUNT?

A standard '_user_account_'
(mshelp://windows/?id=ca5d36ab-2fa7-49bb-bcc1-fe25cae5fef4#gtmt_user_account_def)
lets a person use most of the capabilities of the computer, but
permission from an administrator is required if you want to make changes
that affect other users or the security of the computer.
When you use a standard account, you can use most programs that are
installed on the computer, but you can't install or uninstall software
and hardware, delete files that are required for the computer to work,
or change settings on the computer that affect other users. If you're
using a standard account, some programs might require you to provide an
administrator password before you can perform certain tasks.
<H1 CLASS=TITLE>WHAT IS AN ADMINISTRATOR ACCOUNT?</H1>
AN ADMINISTRATOR ACCOUNT IS A
_USER_ACCOUNT_
(\"MSHELP://WINDOWS/?ID=CA5D36AB-2FA7-49BB-BCC1-FE25CAE5FEF4#GTMT_USER_ACCOUNT_DEF\")
THAT LETS YOU MAKE CHANGES THAT WILL AFFECT OTHER USERS. ADMINISTRATORS
CAN CHANGE SECURITY SETTINGS, INSTALL SOFTWARE AND HARDWARE, AND ACCESS
ALL FILES ON THE COMPUTER. ADMINISTRATORS CAN ALSO MAKE CHANGES TO OTHER
USER ACCOUNTS.
WHEN YOU SET UP WINDOWS, YOU'LL BE REQUIRED TO CREATE A USER ACCOUNT.
THIS ACCOUNT IS AN ADMINISTRATOR ACCOUNT THAT ALLOWS YOU TO SET UP YOUR
COMPUTER AND INSTALL ANY PROGRAMS THAT YOU WOULD LIKE TO USE. ONCE YOU
HAVE FINISHED SETTING UP YOUR COMPUTER, WE RECOMMEND THAT YOU USE A
STANDARD USER ACCOUNT FOR YOUR DAY-TO-DAY COMPUTING. IT'S MORE SECURE TO
USE A
_STANDARD_USER_ACCOUNT_
(\"MSHELP://WINDOWS/?ID=E28D50D9-3F22-49FB-A18E-041C84508643#GTMT_STANDARD_ACCOUNT_DEF\")
INSTEAD OF AN ADMINISTRATOR ACCOUNT.
<H3 CLASS=TITLE_RELATEDLINKS>
</H3>

Hi there,

Many thanks for that which leads me to a second question the built in
administrator account if I password protect that account can a user with
administrator rights then delete the password on the built in administrator
account?

Many thanks, Tim.

 

[Tim]

Hello Tim,
Yes, if you have 2 admin accounts, one can make changes to another
admin account. HOWEVER, you are using built-in admin account as example
which has an exception : you cannot change built-in admin account to
normal user account. It remains as admin account with or without
password.
So, that's what you were getting at from the beginning. I misunderstood
what you said because we are used to call administrator account ( as in
account with admin rights ) or user account ( as in account Without
admin rights). That's how we differentiate them, it's less confusing .
Hope I have answered your questions.

Hi there,

No you were right first time but I then discovered the Administrator account
(hidden) what I need to know is if I set a Password in the hidden
Administrator account can anyone with a normal administrator account access
and delete that password?

Hope that explains it correctly, Tim.

 

[Tim]

Hello Tim,
Yes, you can delete the built-in admin's password with a normal admin
account, but the built-in will still remain as administrator -- that you
cannot change.

Hi there,

This is baffling what we want to do is have users with administration rights
so they can load programs, surf etc and I thought that surely a user with
administration rights could not override the hidden administrators password
that seems mad.

Is there some way we can achieve our goal?

Many thanks, Tim.

 

[Tim]

Hello Tim,
I believe I can safely assume that the reason all these questions
raised was because there was someone else in mind. You are concerned
that that someone might mess around with the built-in admin account.(I'm
a gambler. I'm banking on this.)
Technically speaking, and a lot of people will say more or less the
same, that you SHOULDN'T keep the built-in admin Active. Enable it Only
when you need it. I would suggest you do exactly that, IF you are not
the only one using this computer.
The other way is to give that someone an user account( no admin rights
), so there will be no danger/damage done to your computer.

Hi there,

You're right this is about protecting our computers and stopping the odd
person who will abuse them.

The hidden administrator account on each computer is hidden but of course
anyone with a bit of sense and the ability to read could access that hidden
account and take control of the whole computer blocking us out, although I
know we can use the Vista disk and go back to restore points thus at least
getting our computer back from the person who has tried to hi-jack it but by
then the damage could be done.

But I am amassed that the hidden administrator account cannot be fully
protected and thus gives the opportunity to some people to screw up our
computers.

Again many thanks for your input, Tim.

 

[Tim]

Hi Tim

What version of Vista do you have?

If you use Ultimate, you can set up normal User accounts for anyone
else and then use the Group Policy to allow those accounts to do some
other things, like installing programs and surf as they need, or
whatever else you want to allow those accounts to do WITHOUT them having
any rights to make system or user changes.

Group Policy can allow you to attach certain rights to a normal user
account, so they can do some elevated stuff, but you still retain the
only Admin priviledges so they can't be deleting passwords or messing up
anything you don't llow them to.


--
Chappy

::*_DAVE_* ::- vista ultimate 64bit - nzxt lexa classic case - asus
commando mobo (p965/ich8r) - intel e6750 core 2 - zalman 9700 cpu cooler
- 4g's crucial ballistix tracer ddr2 pc26400 ram - bfg 8800gts oc2 320mb
- 2 x 22\" w2207 lcd monitors - 2 x 250g, 2 x 500g sata ii hdd's, 2 dvd
burners c/w lightscribe (sony, tsst) - enermax noisetaker ii 600w psu
with custom chrome cable sleeving - hauppauge hdtv tv tuner card - 5.1
logitech z5500 speakers - 15 in 1 multi-card reader

::*We will _NEVER_ Forget!*::

Hi there,

Unfortunately these computers only came with Home Premium I will investigate
if a Standard User can be assigned install and surf privileges.

Many thanks, Tim.