Group Policy Editor

[ed black]

I run xp media center and the user accounts can't run installed programs. I
went to the group policy editor in an admin account and clicked the user
configuration,software configuration and there is no software installation
node like the help files say there is. I don't want to let guests run in an
admin account. And I want to run programs that access the web from a limited
account for internet security purposes.

What can I do to allow user groups to access software programs?

 

[Lanwench [MVP - Exchange]]

I run xp media center and the user accounts can't run installed
programs. I went to the group policy editor in an admin account and
clicked the user configuration,software configuration and there is no
software installation node like the help files say there is. I don't
want to let guests run in an admin account. And I want to run
programs that access the web from a limited account for internet
security purposes.

What can I do to allow user groups to access software programs?

I'm presuming you don't mean *all* installed programs, surely. If so,
someone has mucked with things very badly and you may have a reinstall in
your future.

If you mean *some* programs - group policy isn't where you do stuff like
this, especially as you aren't on a domain. Don't do anything in there.

Instead, you need to find out what permissions the specific problem apps is
expecting (in the registry and file system) and change the permissions
accordingly.

Google for "Process Explorer" - a Sysinternals tool now owned by MS - and
see whether it helps you identify the locations. Log in as an admin, but
launch Process Explorer using runas & specify an admin account - then try to
launch the app.

Oh - and don't forget to complain to the product developers about their
sloppy code. Users should not need admin rights to run desktop software.

 

[ed black]

I'm presuming you don't mean *all* installed programs, surely. If so,
someone has mucked with things very badly and you may have a reinstall in
your future.

If you mean *some* programs - group policy isn't where you do stuff like
this, especially as you aren't on a domain. Don't do anything in there.

Instead, you need to find out what permissions the specific problem apps is
expecting (in the registry and file system) and change the permissions
accordingly.

Google for "Process Explorer" - a Sysinternals tool now owned by MS - and
see whether it helps you identify the locations. Log in as an admin, but
launch Process Explorer using runas & specify an admin account - then try to
launch the app.

Oh - and don't forget to complain to the product developers about their
sloppy code. Users should not need admin rights to run desktop software.

Ok thanks Lanwench! You're right, it's not all apps, just some apps. I'll
try what you suggest. And I'm frustrated with the developers because when I
go to 'Help and Support' from the start menu, it explains all about the Group
Policy editor and how to allow software permissions in user configuration,
then surprise, surprise, it's not set up on xp media center. What a waste of
a couple hours fooling around with that. I trusted that the help/support
center installed with the OS would refer to my OS; and that's not the case
here. If I knew who to complain to I would, it's just that sifting through
all the forums, newsgroups, technets is tedious and I can't seem to find the
'complaints department'

 

[ed black]

why am i not surprised that this newsgroup is not firefox friendly? I tried
to reply to this thread in firefox and got nowhere. So here I am in ie7
hoping I don't get the dreaded 'needs to close encountered problem' treatment

Anyway, the 'process explorer' app doesn't look like it will solve anything
for me. And if I need to edit registries and write code for the OS, I'm not
going to be able to do it.

Why can't limited accounts and guest accounts run software I install at the
admin level?

If they can't install their own programs and can't run programs installed in
admin, then what good are limited and guests accounts?

I can run MS office apps and ie7 and firefox and those things, but when I
try to run a game or 3d party software, I get the 'can't write to so and so'
message.

I'm no computer programmer or IT guy, but i'd really like to use the limited
and guest accounts. Is there an 'easy' way to make it work besides editing
registries and writing code for xp media center?

 

[Shenan Stanley]

<prior messages not relevant to my comment - snipped>

why am i not surprised that this newsgroup is not firefox friendly?
I tried to reply to this thread in firefox and got nowhere. So
here I am in ie7 hoping I don't get the dreaded 'needs to close
encountered problem' treatment

<snipped>

Microsoft Newsgroups: Frequently Asked Questions
http://www.microsoft.com/communities/guide/newsgroupfaq.mspx

How to Configure Outlook Express for Internet News
http://support.microsoft.com/kb/171164

How to Subscribe to Newsgroups in Outlook Express
http://support.microsoft.com/kb/171190

A little more detail...
http://www.michaelstevenstech.com/outlookexpressnewreader.htm

If you want to search for older posts than you may choose to keep on your
computer...
http://groups.google.com/

 

[Lanwench [MVP - Exchange]]

Ok thanks Lanwench! You're right, it's not all apps, just some
apps. I'll try what you suggest. And I'm frustrated with the
developers because when I go to 'Help and Support' from the start
menu, it explains all about the Group Policy editor and how to allow
software permissions in user configuration, then surprise, surprise,
it's not set up on xp media center.

MCE is odd, indeed.

What a waste of a couple hours
fooling around with that. I trusted that the help/support center
installed with the OS would refer to my OS; and that's not the case
here. If I knew who to complain to I would, it's just that sifting
through all the forums, newsgroups, technets is tedious and I can't
seem to find the 'complaints department'

Not sure what you searched for in Help & Support - even *outside* of MCE,
this would not be a group policy issue. If you google for "limited user"
application error <etc> you will find a lot.

You ought to be complaining to the doofuses who wrote the third party
applications which your end users cannot run.

 

[ed black]

<prior messages not relevant to my comment - snipped>


<snipped>

Microsoft Newsgroups: Frequently Asked Questions
http://www.microsoft.com/communities/guide/newsgroupfaq.mspx

How to Configure Outlook Express for Internet News
http://support.microsoft.com/kb/171164

How to Subscribe to Newsgroups in Outlook Express
http://support.microsoft.com/kb/171190

A little more detail...
http://www.michaelstevenstech.com/outlookexpressnewreader.htm

If you want to search for older posts than you may choose to keep on your
computer...
http://groups.google.com/

thanks shenan I will stick with using MS Outlook for email and not outlook
express and I want to look at the news group in the browser


Looks like I derailed my own post any way back on topic I can't find
anywhere to answer the question about how to allow users to access 'some'
programs that the admin installs. Nowhere is there a place to send feedback
or submit bugs to Microsoft.

Will someone please help

 

[Lanwench [MVP - Exchange]]

why am i not surprised that this newsgroup is not firefox friendly?

You wouldn't use Firefox to access a *newsgroup* - it's a web browser.
Thunderbird is a newsreader. Don't use the crummy web interface to access
these groups at all and you'll be a lot happier. See below.

I tried to reply to this thread in firefox and got nowhere. So here
I am in ie7 hoping I don't get the dreaded 'needs to close
encountered problem' treatment

Anyway, the 'process explorer' app

My apologies - I was in autopilot mode...sorry! It was a lot eaiser to
remember the product names before Sysinternals was absorbed into the
collective. It's actually Process *Monitor* -

http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx

doesn't look like it will solve
anything for me. And if I need to edit registries and write code for
the OS, I'm not going to be able to do it.

Ain't no code to write. However, you will indeed need to edit the registry
and you will indeed need to edit some NTFS permissions in the file system.

Why can't limited accounts and guest accounts run software I install
at the admin level?

Because the people who wrote the software are lazy eedjits? What do the
developers say when you ask them? If their answer is "Make the users admins"
then tell them to go pound sand.

If they can't install their own programs and can't run programs
installed in admin, then what good are limited and guests accounts?

There should be no"guest" enabled if you value your security, and Limited
User means just that - they *shouldn't* be installing software, etc.

Limited users should be able to *run* programs you installed as an admin.

I can run MS office apps and ie7 and firefox and those things, but
when I try to run a game or 3d party software, I get the 'can't
write to so and so' message.

See "eedjit" comment above.

I'm no computer programmer or IT guy, but i'd really like to use the
limited and guest accounts. Is there an 'easy' way to make it work
besides editing registries and writing code for xp media center?

Again, there's no code to write - and check out the correct Sysinternals
tool I mentioned above. Sorry for the confusion; I was multitasking.

Re your access to the groups:

Try using a news client, such as Forte Agent, Thunderbird, or even Outlook
Express, rather than the pretty clunky web interface to the newsgroups. It's
a lot easier to do nearly everything that way. You can mark messages to be
watched, filter the views so you can see replies to your posts easily, and
search.

The Microsoft public news server is msnews.microsoft.com and you can
subscribe to as many groups as you like; no authentication is required.

The following is from a post by MVP Malke ...

-------------------------------------------------------
Here's information on Usenet and using a newsreader:

http://www.elephantboycomputers.com/page3.html#12-09-02 - a brief
explanation of newsgroups
http://michaelstevenstech.com/outlo...ssnewreader.htm
http://rickrogers.org/setupoe.htm
http://support.microsoft.com/defaul...wto/default.asp
- Set Up Newsreader

http://www.dts-l.org/goodpost.htm

http://aumha.org/nntp.htm - list of MS newsgroups
microsoft.public.test.here - MS group to test if your newsreader is
working properly
http://www.mailmsg.com/SPAM_munging.htm - how to munge email address
http://www.blakjak.demon.co.uk/mul_crss.htm - multiposting vs.
crossposting

Some newsreaders for Windows
http://www.forteinc.com/agent/index.php - for Forte
http://www.mozilla.org (Thunderbird does newsgroups)
http://gravity.tbates.org/

-------------------------------------

 

[ed black]

:

Not sure what you searched for in Help & Support - even *outside* of MCE,
this would not be a group policy issue. If you google for "limited user"
application error <etc> you will find a lot.

You ought to be complaining to the doofuses who wrote the third party
applications which your end users cannot run.

Thanks for clarifying that sysinternal app. I'll look into that later.
I'll try to walk through the 'Help and Support' on the start menu

Open Help and Support
Pick a Help topic -- System administration
Security and administration tools
Overviews, articles, and tutorials -- Using Group Policy

"In an environment where you have one stand-alone computer or several
computers joined in a workgroup, you can still use Group Policy to customize
your computer.

To open Group Policy

Click Start, and then click Run.
Type gpedit.msc and then click OK.
When Group Policy opens, you will see two options in Local Computer Policy:
Computer Configuration and User Configuration. Computer Configuration allows
you to set policies that apply to your computer, regardless of who logs on.
User Configuration allows you to set policies that apply to each user who
logs on to the computer."


" To open the Software Installation snap-in
Open the Group Policy snap-in.
To assign software applications to computers, in the console tree
double-click Computer Configuration. To assign or publish software
applications to users, in the console tree double-click User Configuration.
Double-click Software Settings, and then click Software installation.
Where?

policy name Policy
Computer Configuration (or User Configuration)
Software Settings
Software installation"


And at the part where I get to 'Software Installation' it's not there.
I open up the Software Settings Folder and it's empty. It's a dead end.
Nothing to do in the 'Software Settings Folder'

I gotta run. I'll look at the process thing after work.

Thanks again Lanwench

 

[Lanwench [MVP - Exchange]]

:



Thanks for clarifying that sysinternal app. I'll look into that
later. I'll try to walk through the 'Help and Support' on the start
menu

Open Help and Support
Pick a Help topic -- System administration
Security and administration tools
Overviews, articles, and tutorials -- Using Group Policy

OK - bu why would you search for or pick that option? Again: this isn't a
policy issue at all. It's really no more useful in your situation than if
you searched for "how do I use Notepad.exe"

"In an environment where you have one stand-alone computer or
several computers joined in a workgroup, you can still use Group
Policy to customize your computer.

To open Group Policy

Click Start, and then click Run.
Type gpedit.msc and then click OK.
When Group Policy opens, you will see two options in Local Computer
Policy: Computer Configuration and User Configuration. Computer
Configuration allows you to set policies that apply to your computer,
regardless of who logs on. User Configuration allows you to set
policies that apply to each user who logs on to the computer."


" To open the Software Installation snap-in
Open the Group Policy snap-in.
To assign software applications to computers, in the console tree
double-click Computer Configuration. To assign or publish software
applications to users, in the console tree double-click User
Configuration. Double-click Software Settings, and then click
Software installation. Where?

policy name Policy
Computer Configuration (or User Configuration)
Software Settings
Software installation"


And at the part where I get to 'Software Installation' it's not
there.
I open up the Software Settings Folder and it's empty. It's a dead
end. Nothing to do in the 'Software Settings Folder'

I gotta run. I'll look at the process thing after work.

Thanks again Lanwench

No problem. I think you're correct in that there's an error in the Help &
Support (without a domain, you technically don't have group policy - you
just have a local policy).

However, this is not a group policy thing - you don't even have group policy
because you aren't on a domain. You have a local policy, and you do NOT want
to mess with it - you'd end up locking yourself out too.

This is a permissions issue, plain and simple - in the file system & perhaps
also in the registry. And it's due to the developers.

 

[ed black]

You wouldn't use Firefox to access a *newsgroup* - it's a web browser.
Thunderbird is a newsreader. Don't use the crummy web interface to access
these groups at all and you'll be a lot happier. See below.


My apologies - I was in autopilot mode...sorry! It was a lot eaiser to
remember the product names before Sysinternals was absorbed into the
collective. It's actually Process *Monitor* -

http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx

I don't see anything there that will allow the user to run the programs

Ain't no code to write. However, you will indeed need to edit the registry
and you will indeed need to edit some NTFS permissions in the file system.

I'll spend some time looking at the registry edit tutorials and NTFS tutorials

Because the people who wrote the software are lazy eedjits? What do the
developers say when you ask them? If their answer is "Make the users admins"
then tell them to go pound sand.

If I could find the link to inform the devs, then I would. It's not on
microsoft.com
When I go there it leads to some crazy connect.microsoft.com place to sign
up for some online seminars or something

There should be no"guest" enabled if you value your security, and Limited
User means just that - they *shouldn't* be installing software, etc.

You're right I shouldn't allow them to install software. I didn't know that
enabling the guest would compromise security. I'll change that.

Limited users should be able to *run* programs you installed as an admin.

Still looking for a way to do it.

See "eedjit" comment above.

Again, there's no code to write - and check out the correct Sysinternals
tool I mentioned above. Sorry for the confusion; I was multitasking.

The tool looks cool and all but I don't have the skills to understand what
to do after I see all the data.

Re your access to the groups:

Try using a news client, such as Forte Agent, Thunderbird, or even Outlook
Express, rather than the pretty clunky web interface to the newsgroups. It's
a lot easier to do nearly everything that way. You can mark messages to be
watched, filter the views so you can see replies to your posts easily, and
search.

The Microsoft public news server is msnews.microsoft.com and you can
subscribe to as many groups as you like; no authentication is required.

The following is from a post by MVP Malke ...

-------------------------------------------------------
Here's information on Usenet and using a newsreader:

http://www.elephantboycomputers.com/page3.html#12-09-02 - a brief
explanation of newsgroups
http://michaelstevenstech.com/outlo...ssnewreader.htm
http://rickrogers.org/setupoe.htm
http://support.microsoft.com/defaul...wto/default.asp
- Set Up Newsreader

http://www.dts-l.org/goodpost.htm

http://aumha.org/nntp.htm - list of MS newsgroups
microsoft.public.test.here - MS group to test if your newsreader is
working properly
http://www.mailmsg.com/SPAM_munging.htm - how to munge email address
http://www.blakjak.demon.co.uk/mul_crss.htm - multiposting vs.
crossposting

Some newsreaders for Windows
http://www.forteinc.com/agent/index.php - for Forte
http://www.mozilla.org (Thunderbird does newsgroups)
http://gravity.tbates.org/

I know I'm a n00b in the newsgroups. I don't have the desire right now to
go any deaper.

 

[ed black]

Right, I never googled 'limited user' application error.

OK - bu why would you search for or pick that option? Again: this isn't a
policy issue at all. It's really no more useful in your situation than if
you searched for "how do I use Notepad.exe"

It went something like I found the problem, went to microsoft, typed in some
questions and keywords, 'user can't run software' 'user account problem'
stuff like that. Everything led to group policy editor so I went to run as
and did gpedit.msc and didn't understand it, so I went to the H&S and looked
it up

No problem. I think you're correct in that there's an error in the Help &
Support (without a domain, you technically don't have group policy - you
just have a local policy).

However, this is not a group policy thing - you don't even have group policy
because you aren't on a domain. You have a local policy, and you do NOT want
to mess with it - you'd end up locking yourself out too.

You say it's not a group policy thing and technet.microsoft says it is. I'm
willing to try your fix, but so far I'm at a loss at what my next step would
be after I dl the process monitor and run it.

This is a permissions issue, plain and simple - in the file system & perhaps
also in the registry. And it's due to the developers.

I can't be the only one with MCE who has this issue. I'd like to report it,
but like I've said before, there is no 'submit a bug to the developer' link
that I can find

 

[Lanwench [MVP - Exchange]]

I don't see anything there that will allow the user to run the
programs

Download it and run it as I suggested, find where it fails, and manually
change the permissions.

I'll spend some time looking at the registry edit tutorials and NTFS
tutorials



If I could find the link to inform the devs, then I would. It's not
on microsoft.com

Right, because this is *not* *Microsoft*. It's your third party software
developers....as I've now stated three times

When I go there it leads to some crazy connect.microsoft.com place to
sign
up for some online seminars or something



You're right I shouldn't allow them to install software. I didn't
know that enabling the guest would compromise security. I'll change
that.
Good.

Still looking for a way to do it.

See above - I've already explained what you'll need to do.

The tool looks cool and all but I don't have the skills to understand
what
to do after I see all the data.

Sorry, I don't know how to help further.

I know I'm a n00b in the newsgroups. I don't have the desire right
now to
go any deaper.

Your call.

 

[Lanwench [MVP - Exchange]]

Right, I never googled 'limited user' application error.


It went something like I found the problem, went to microsoft, typed
in some questions and keywords, 'user can't run software' 'user
account problem' stuff like that. Everything led to group policy
editor so I went to run as and did gpedit.msc and didn't understand
it, so I went to the H&S and looked it up

OK. But most of IT is knowing how to search - learning by trial and error.
You're welcome. But please don't muck around in your local computer policy.
You'll likely lock yourself out.

You say it's not a group policy thing and technet.microsoft says it
is. I'm willing to try your fix, but so far I'm at a loss at what my
next step would be after I dl the process monitor and run it.


I can't be the only one with MCE who has this issue. I'd like to
report it, but like I've said before, there is no 'submit a bug to
the developer' link that I can find

This is not an MCE issue.
This is not a Microsoft issue.

This is an issue with the PEOPLE WHO WROTE THE !@#$ SOFTWARE THAT WON'T RUN

(sorry for yelling, I've already tried to be clear about this several times)

 

[ed black]

OK. But most of IT is knowing how to search - learning by trial and error.
You're welcome. But please don't muck around in your local computer policy.
You'll likely lock yourself out.


This is not an MCE issue.
This is not a Microsoft issue.

This is an issue with the PEOPLE WHO WROTE THE !@#$ SOFTWARE THAT WON'T RUN

(sorry for yelling, I've already tried to be clear about this several times)

I find it interesting that you insist it's not a microsoft issue. I'll
repeat what I went through earlier


" To open the Software Installation snap-in


The microsoft H&S files written in the OS and supplied with thexp MCE OS say
this can be done.

I GET THERE AND THE FOLDERS EMPTY --- no "Software Installation" node in
the "Software Settings" Folder.

You and I can yell and shout all we want. It doesn't change this fact.
Forget about my 3d party software that doesn't run. That's no longer the
issue, explain the issue with the empty "Software Settings" Folder.

Or do you even care that there's a flaw in the MS component? Is it so
trivial, that I as an End User shouldn't be concerned about it.

You're probably right, I probably shouldn't mess with the Local Policy or
the Group policy, But like I said, there's a problem with the GPE. I
understand that xp mce is obsolete and Vista is the latest flavor, but at
least recognize there's a problem with the GPE. You can't deny it, I can
supply screenshots or whatever.

Good Day, And you don't need to reply again if you're going to skirt the
issue of the flawed GPE.

 

[Lanwench [MVP - Exchange]]

The microsoft H&S files written in the OS and supplied with thexp MCE
OS say this can be done.

You continue to bark up the wrong tree.

I GET THERE AND THE FOLDERS EMPTY --- no "Software Installation"
node in the "Software Settings" Folder.

You and I can yell and shout all we want. It doesn't change this
fact. Forget about my 3d party software that doesn't run. That's no
longer the issue, explain the issue with the empty "Software
Settings" Folder.

In a *local* policy this does not exist. It certainly exists in *domain*
policies....and I've already agreed that help & support in XP is incorrect
here. I'm sure Microsoft has been made aware of this - it isn't the first
time it's happened.

Or do you even care that there's a flaw in the MS component? Is it so
trivial, that I as an End User shouldn't be concerned about it.

What "component"? You're talking about a badly-written help file, not group
policy itself.

You're probably right, I probably shouldn't mess with the Local
Policy or the Group policy,

That's correct - and you don't *have* a "group" policy. You are not
administering a domain.

But like I said, there's a problem with
the GPE. I understand that xp mce is obsolete and Vista is the
latest flavor, but at least recognize there's a problem with the
GPE. You can't deny it, I can supply screenshots or whatever.

Vista, MCE, XP, it doesn't matter. This is a permissions issue in the
registry and file system, plain and simple, and cannot be addressed via
policy....period.

Good Day, And you don't need to reply again if you're going to skirt
the issue of the flawed GPE.

(sigh)

The policy editor isn't the problem. I have my own XP box here & it's the
same. When I work with policies in a domain environment (which MCE can't
even join, mind you) I have these options available to me. Misleading? Yes,
I can see that - but only if you're looking at group policy help files,
which concern a topic entirely irrelevant to your original post.

Again: even in a domain this is not how one handles a situation like yours,
which involves modifying permissions in the filesystem and registry to
permit non-admins to run badly written third party apps Software
installation has nothing to do with this - nor does software restriction
(another area you wouldn't want to mess with).

I've done my best to direct you in the right direction but it is becoming
evident you aren't all that interested in fixing the actual problem that
caused you to write your post in the first place, which you surely could
have done by now if you'd investigated the Sysinternals tool and modified
your permissions. If you can't figure out how to change the permissions
(which is a fairly basic task in Windows!) you would definitely not want to
get involved in policy settings or you will end up with an unusable
computer.

I'm now done - I wish you luck in solving your problem.

 

[ed black]

Okay I finally came across the disclaimer in the help files

" . . . because Group Policy can have snap-in extensions added to or removed
from it, the exact set of subitems that you see might be different."

then I came across this item

http://support.microsoft.com/kb/555218/en-us

I followed the directions and the system confirmed that the extension was
successfully registered. There was still no "Software Installation" subitem
when I restarted the GPE.

Then I found this

http://technet.microsoft.com/en-us/library/bb742376.aspx

Still didn't work after I followed the directions and added the snap-in and
all extensions. Strangely enough, the Software Installation snap-in
extension was included in the check box for adding extensions. I did the
restart and everything.



I'm resigned that I can't operate the GPE for user configuration of software
installation.

I do however suspend belief that the Snap-In won't work for me on this
computer until I see for myself if it works or not, but since it's not
available for me to attempt, then I won't say it can't work or will work for
my purposes to allow limited users to run some apps. I admit I'm a novice
end-user and for what it's worth I do respect your knowledge, experience and
wisdom. It's just that I need to experience for myself whether or not the
GPE will resolve my issue.

That being said, I have to start looking for the tutorials on what you've
described by editing registry and learning NFTS. I don't have time right
now, so I'm going to have to live with fast user switching to go from the
limited accts to admin when I need to check the weather or do screen captures
and uploads to image sites. I've also discovered that the FPS multiplayer
online game that I use can only be run in admin anyway because of the
PunkBuster Anti-Cheat requirements.

 

[Lanwench [MVP - Exchange]]

Okay I finally came across the disclaimer in the help files

" . . . because Group Policy can have snap-in extensions added to or
removed from it, the exact set of subitems that you see might be
different."

then I came across this item

http://support.microsoft.com/kb/555218/en-us

I followed the directions and the system confirmed that the extension
was successfully registered. There was still no "Software
Installation" subitem when I restarted the GPE.

Then I found this

http://technet.microsoft.com/en-us/library/bb742376.aspx

Still didn't work after I followed the directions and added the
snap-in and all extensions. Strangely enough, the Software
Installation snap-in extension was included in the check box for
adding extensions. I did the restart and everything.



I'm resigned that I can't operate the GPE for user configuration of
software installation.

But *installation* isn't your issue anyway, though. You'd have the same
problem, as the installers for your applications are not doing what they
should do, which is set permissions accordingly so that end users can use
them.

I do however suspend belief that the Snap-In won't work for me on this
computer until I see for myself if it works or not, but since it's not
available for me to attempt, then I won't say it can't work or will
work for my purposes to allow limited users to run some apps.

OK, don't say it. I will. That is not what it is for.

I
admit I'm a novice end-user and for what it's worth I do respect your
knowledge, experience and wisdom. It's just that I need to
experience for myself whether or not the GPE will resolve my issue.

Sure, go to town.

That being said, I have to start looking for the tutorials on what
you've described by editing registry and learning NFTS. I don't have
time right now, so I'm going to have to live with fast user switching
to go from the limited accts to admin when I need to check the
weather or do screen captures and uploads to image sites. I've also
discovered that the FPS multiplayer online game that I use can only
be run in admin anyway because of the PunkBuster Anti-Cheat
requirements.

I'm really not sure what you're looking for where "how to change
permissions" is concerned or I would happily have given you a link. This is
really pretty basic stuff - it's been pretty much the same since NT first
came out. Google should help.

Good luck out there....