Power users can see administrators?

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

If you want to hide your personal files (if your an adminsitrator), from
peeping eyes of any limited user/ power user, than open "My Computer." RIGHT
CLICK on the administrative account and RIGHT CLICK the file. Click on the
"sharing" tab and tick the "Make the folder private!" I HOPE THIS ANSWERS
YOUR QUESTION!
 
Where is this happenening - on the local computer or in Active Directory?? --- Steve


Hello,

I notice that power users can browse who are administrator accounts by default. Is there a security policy option to disable this behavior? I need most of the power user's rights, but don't want this account knows anything about the higher level accounts.

Best regards,
Zhenxin Li
 
Hello,

I notice that power users can browse who are administrator accounts by default. Is there a security policy option to disable this behavior? I need most of the power user's rights, but don't want this account knows anything about the higher level accounts.

Best regards,
Zhenxin Li
 
Well that would be hard to do. Any user can run the command net localgroup administrators to see members of administrators group. What you must do is to make sure that the local administrators use strong passwords so that other users can not guess. You can use local Group Policy [gpedit.msc] or the Shared Computer Toolkit to try and restrict users from accessing Control Panel, the command prompt, net.exe, the registry, mmc snapins, etc. The Shared Computer Toolkit generally works better on non domain computers because local Group Policy applies to ALL local computer users including administrators unless you hack permissions to the \windows\system32\group policy\user folder which also cause the admis not to be able to manage local Group Policy. --- Steve
In "Control Panel --- Administrative Tools --- Computer Management --- Local Users and Groups" console.
Where is this happenening - on the local computer or in Active Directory?? --- Steve


Hello,

I notice that power users can browse who are administrator accounts by default. Is there a security policy option to disable this behavior? I need most of the power user's rights, but don't want this account knows anything about the higher level accounts.

Best regards,
Zhenxin Li
 
That is why some admins rename the administrator account though that is only effective for some types of attacks because the built in administrator account is a well known SID that can not be changed. Properly configured firewalls will make sure that users on untrusted networks will not be able to enumerate users and groups. For high security within a network admins often can only logon via a smart card. --- Steve
Hmmm, it's really stupid to expose the admin account name to the world. At least, there should be an option to protect the name. Thank you!
Well that would be hard to do. Any user can run the command net localgroup administrators to see members of administrators group. What you must do is to make sure that the local administrators use strong passwords so that other users can not guess. You can use local Group Policy [gpedit.msc] or the Shared Computer Toolkit to try and restrict users from accessing Control Panel, the command prompt, net.exe, the registry, mmc snapins, etc. The Shared Computer Toolkit generally works better on non domain computers because local Group Policy applies to ALL local computer users including administrators unless you hack permissions to the \windows\system32\group policy\user folder which also cause the admis not to be able to manage local Group Policy. --- Steve
In "Control Panel --- Administrative Tools --- Computer Management --- Local Users and Groups" console.
Where is this happenening - on the local computer or in Active Directory?? --- Steve


Hello,

I notice that power users can browse who are administrator accounts by default. Is there a security policy option to disable this behavior? I need most of the power user's rights, but don't want this account knows anything about the higher level accounts.

Best regards,
Zhenxin Li
 
In "Control Panel --- Administrative Tools --- Computer Management --- Local Users and Groups" console.
Where is this happenening - on the local computer or in Active Directory?? --- Steve


Hello,

I notice that power users can browse who are administrator accounts by default. Is there a security policy option to disable this behavior? I need most of the power user's rights, but don't want this account knows anything about the higher level accounts.

Best regards,
Zhenxin Li
 
Thanks! But I think this is not my problem.

In "Control Panel --- Administrative Tools --- Computer Management --- Local
Users and Groups" console, power users can see who are administrator
accounts. I want to hide everything about the admin accounts to lower rights
users, including the names of the admin accounts.
 
Hmmm, it's really stupid to expose the admin account name to the world. At least, there should be an option to protect the name. Thank you!
Well that would be hard to do. Any user can run the command net localgroup administrators to see members of administrators group. What you must do is to make sure that the local administrators use strong passwords so that other users can not guess. You can use local Group Policy [gpedit.msc] or the Shared Computer Toolkit to try and restrict users from accessing Control Panel, the command prompt, net.exe, the registry, mmc snapins, etc. The Shared Computer Toolkit generally works better on non domain computers because local Group Policy applies to ALL local computer users including administrators unless you hack permissions to the \windows\system32\group policy\user folder which also cause the admis not to be able to manage local Group Policy. --- Steve
In "Control Panel --- Administrative Tools --- Computer Management --- Local Users and Groups" console.
Where is this happenening - on the local computer or in Active Directory?? --- Steve


Hello,

I notice that power users can browse who are administrator accounts by default. Is there a security policy option to disable this behavior? I need most of the power user's rights, but don't want this account knows anything about the higher level accounts.

Best regards,
Zhenxin Li
 
Back
Top