Microsoft Windows Vista Community Forums - Vistaheads
Recommended Download



Welcome to the Microsoft Windows Vista Community Forums - Vistaheads, YOUR Largest Resource for Windows Vista related information.

You are currently viewing our boards as a guest which gives you limited access to view most discussions and access our other features. By joining our free community you will have access to post topics, communicate privately with other members (PM), respond to polls, upload content and access many other special features. Registration is fast, simple and absolutely free so , join our community today!

If you have any problems with the registration process or your account login, please contact us.

Driver Scanner

Standard Users Privileges

microsoft.public.windows.vista.administration accounts passwords






Speedup My PC
Reply
  #1 (permalink)  
Old 07-03-2007
Sam
 

Posts: n/a
Standard Users Privileges
My goal, when I bought a new Windows Vista Ultimate computer for my son's 8th
grade graduation, was to give him a tool to do his high school research and
homework, at the same time controlling the time that he spent on the computer
playing games. He spent too much time playing online game in middle school
and his grades suffered as a result.

When I configured Windows Vista Ultimate, I setup myself as the Vista
Administrator and set him up as a Vista Standard User. Then I enabled
Parental Controls and set computer usage time limits.

However, as a Windows Vista Ultimate Standard User, he cannot download
research or other files from the internet and/or he cannot install any
programs (educational or not).

The bottom line is that I want give him all the rights of a Windows Vista
Administrator, with the following exceptions:
* I do not want to let him remove or modify the Parental Controls in any way
* I do not want to let him change his own or other peoples privileges.
* I do not want him to change other user's, like his sister, password, but
he should be able to change his own password.
* I do not want him to change the Windows Live OneCare firewall and other
settings. Windows Live OneCare should block him from downloading and
installing spyware or viruses.

Can someone please tell me how to enable this in Windows Vista Ultimate?

Thanks,

Sam
Software Quality Assurance (SQA) Engineer

Reply With Quote
Sponsored Links
  #2 (permalink)  
Old 07-03-2007
Gistcheckin
 

Posts: n/a
RE: Standard Users Privileges
Installing a Package with Elevated Privileges for a Non-Admin
http://msdn2.microsoft.com/en-us/library/aa369519.aspx
--
Gistcheckin


"Sam" wrote:

> My goal, when I bought a new Windows Vista Ultimate computer for my son's 8th
> grade graduation, was to give him a tool to do his high school research and
> homework, at the same time controlling the time that he spent on the computer
> playing games. He spent too much time playing online game in middle school
> and his grades suffered as a result.
>
> When I configured Windows Vista Ultimate, I setup myself as the Vista
> Administrator and set him up as a Vista Standard User. Then I enabled
> Parental Controls and set computer usage time limits.
>
> However, as a Windows Vista Ultimate Standard User, he cannot download
> research or other files from the internet and/or he cannot install any
> programs (educational or not).
>
> The bottom line is that I want give him all the rights of a Windows Vista
> Administrator, with the following exceptions:
> * I do not want to let him remove or modify the Parental Controls in any way
> * I do not want to let him change his own or other peoples privileges.
> * I do not want him to change other user's, like his sister, password, but
> he should be able to change his own password.
> * I do not want him to change the Windows Live OneCare firewall and other
> settings. Windows Live OneCare should block him from downloading and
> installing spyware or viruses.
>
> Can someone please tell me how to enable this in Windows Vista Ultimate?
>
> Thanks,
>
> Sam
> Software Quality Assurance (SQA) Engineer
>

Reply With Quote
  #3 (permalink)  
Old 07-03-2007
Ronnie Vernon MVP
 

Posts: n/a
Re: Standard Users Privileges
Sam

With Vista Ultimate you have the resources provided by the Group Policy
(gpedit.msc) and the Security Policy (SecPol.msc) components.

These tools can accomplish just about anything you need to open or lock down
any component in the system. It may take you a short time to learn, but it
is well worth the effort.

Resources for Learning About Group Policy for Windows Vista:
http://technet2.microsoft.com/Window...0ef971033.mspx

Download details: Group Policy Settings Reference:
http://www.microsoft.com/downloads/d...DisplayLang=en

--

Ronnie Vernon
Microsoft MVP
Windows Shell/User


"Sam" <Sam@discussions.microsoft.com> wrote in message
news:BCF32B12-C752-42F5-A274-BC8E6F3E7963@microsoft.com...
> My goal, when I bought a new Windows Vista Ultimate computer for my son's
> 8th
> grade graduation, was to give him a tool to do his high school research
> and
> homework, at the same time controlling the time that he spent on the
> computer
> playing games. He spent too much time playing online game in middle
> school
> and his grades suffered as a result.
>
> When I configured Windows Vista Ultimate, I setup myself as the Vista
> Administrator and set him up as a Vista Standard User. Then I enabled
> Parental Controls and set computer usage time limits.
>
> However, as a Windows Vista Ultimate Standard User, he cannot download
> research or other files from the internet and/or he cannot install any
> programs (educational or not).
>
> The bottom line is that I want give him all the rights of a Windows Vista
> Administrator, with the following exceptions:
> * I do not want to let him remove or modify the Parental Controls in any
> way
> * I do not want to let him change his own or other peoples privileges.
> * I do not want him to change other user's, like his sister, password,
> but
> he should be able to change his own password.
> * I do not want him to change the Windows Live OneCare firewall and other
> settings. Windows Live OneCare should block him from downloading and
> installing spyware or viruses.
>
> Can someone please tell me how to enable this in Windows Vista Ultimate?
>
> Thanks,
>
> Sam
> Software Quality Assurance (SQA) Engineer
>


Reply With Quote
  #4 (permalink)  
Old 07-03-2007
Sam
 

Posts: n/a
RE: Standard Users Privileges

"Gistcheckin" wrote:

> Installing a Package with Elevated Privileges for a Non-Admin
> http://msdn2.microsoft.com/en-us/library/aa369519.aspx


I looked at the url and the first registry entry was in my registry but the
second one was not:

HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Win dows\Installer

What should I do about that?

Thanks,

Sam M.
Software Quality Assurance (SQA) Engineer


> --
> Gistcheckin
>
>
> "Sam" wrote:
>
> > My goal, when I bought a new Windows Vista Ultimate computer for my son's 8th
> > grade graduation, was to give him a tool to do his high school research and
> > homework, at the same time controlling the time that he spent on the computer
> > playing games. He spent too much time playing online game in middle school
> > and his grades suffered as a result.
> >
> > When I configured Windows Vista Ultimate, I setup myself as the Vista
> > Administrator and set him up as a Vista Standard User. Then I enabled
> > Parental Controls and set computer usage time limits.
> >
> > However, as a Windows Vista Ultimate Standard User, he cannot download
> > research or other files from the internet and/or he cannot install any
> > programs (educational or not).
> >
> > The bottom line is that I want give him all the rights of a Windows Vista
> > Administrator, with the following exceptions:
> > * I do not want to let him remove or modify the Parental Controls in any way
> > * I do not want to let him change his own or other peoples privileges.
> > * I do not want him to change other user's, like his sister, password, but
> > he should be able to change his own password.
> > * I do not want him to change the Windows Live OneCare firewall and other
> > settings. Windows Live OneCare should block him from downloading and
> > installing spyware or viruses.
> >
> > Can someone please tell me how to enable this in Windows Vista Ultimate?
> >
> > Thanks,
> >
> > Sam
> > Software Quality Assurance (SQA) Engineer
> >

Reply With Quote
  #5 (permalink)  
Old 07-03-2007
Sam
 

Posts: n/a
Re: Standard Users Privileges
I looked at the two URLS that you offered me and I didn't see anything that
told me clearly and specifically what to do to accomplish what I want to do.
I have a home network with no Active Directory Domain.

Maybe I am slow, but I posed specific authorizations and/or polices that I
wanted in place and I didn't see anything that showed my how to created a
user that could download files, install programs and change his password -
yet NOT be about to change other peoples passwords and change and/or remove
the parental controls.

Can you please break it down to the basic steps?
What happened to the concept of the Power Users group?

Still stumped...
Sam
Software Quality Assurance (SQA) Engineer



"Ronnie Vernon MVP" wrote:

> Sam
>
> With Vista Ultimate you have the resources provided by the Group Policy
> (gpedit.msc) and the Security Policy (SecPol.msc) components.
>
> These tools can accomplish just about anything you need to open or lock down
> any component in the system. It may take you a short time to learn, but it
> is well worth the effort.
>
> Resources for Learning About Group Policy for Windows Vista:
> http://technet2.microsoft.com/Window...0ef971033.mspx
>
> Download details: Group Policy Settings Reference:
> http://www.microsoft.com/downloads/d...DisplayLang=en
>
> --
>
> Ronnie Vernon
> Microsoft MVP
> Windows Shell/User
>
>
> "Sam" <Sam@discussions.microsoft.com> wrote in message
> news:BCF32B12-C752-42F5-A274-BC8E6F3E7963@microsoft.com...
> > My goal, when I bought a new Windows Vista Ultimate computer for my son's
> > 8th
> > grade graduation, was to give him a tool to do his high school research
> > and
> > homework, at the same time controlling the time that he spent on the
> > computer
> > playing games. He spent too much time playing online game in middle
> > school
> > and his grades suffered as a result.
> >
> > When I configured Windows Vista Ultimate, I setup myself as the Vista
> > Administrator and set him up as a Vista Standard User. Then I enabled
> > Parental Controls and set computer usage time limits.
> >
> > However, as a Windows Vista Ultimate Standard User, he cannot download
> > research or other files from the internet and/or he cannot install any
> > programs (educational or not).
> >
> > The bottom line is that I want give him all the rights of a Windows Vista
> > Administrator, with the following exceptions:
> > * I do not want to let him remove or modify the Parental Controls in any
> > way
> > * I do not want to let him change his own or other peoples privileges.
> > * I do not want him to change other user's, like his sister, password,
> > but
> > he should be able to change his own password.
> > * I do not want him to change the Windows Live OneCare firewall and other
> > settings. Windows Live OneCare should block him from downloading and
> > installing spyware or viruses.
> >
> > Can someone please tell me how to enable this in Windows Vista Ultimate?
> >
> > Thanks,
> >
> > Sam
> > Software Quality Assurance (SQA) Engineer
> >

>

Reply With Quote
  #6 (permalink)  
Old 07-03-2007
Gistcheckin
 

Posts: n/a
Re: Standard Users Privileges
Migrating from the Power Users Group
The Power Users group in Windows XP was designed to enable members of the
group to perform system tasks, such as installing applications without
granting full administrator permissions. Power Users also had write access to
areas of the file system and registry that normally only allow administrator
access. Power Users enabled some level of application compatibility;
unfortunately, this did not address a fundamental problem: applications
requiring unnecessary privileges and user rights. UAC does not leverage the
Power Users group, and the permissions granted to the Power Users group on
Windows XP have been removed from Windows Vista. UAC enables standard users
to perform all common configuration tasks. The Power Users group, however, is
still available for backwards compatibility with other versions of Windows.
To use the Power Users group on Windows Vista, a new security template must
be applied to change the default permissions on system folders and the
registry to grant Power Users group permissions equivalent to Windows XP.

To disable UAC from prompting for credentials to install applications

1. Click Start, click All Programs, click Accessories, click Run, type
secpol.msc in the Open text box, and then click OK.

2. From the Local Security Settings console tree, click Local Policies, and
then Security Options.

3. Scroll down and double-click User Account Control: Detect application
installations and prompt for elevation.

4. From the User Account Control: Detect application installations and
prompt for elevation Properties dialog box, click Disabled, and then click OK.

5. Close the Local Security Settings window.


To change the elevation prompt behavior

1. Click Start, click Accessories, click Run, type secpol.msc in the Open
text box, and then click OK.

2. From the Local Security Settings console tree, click Local Policies, and
then Security Options.

3. Scroll down to and double-click User Account Control: Behavior of the
elevation prompt for administrators or User Account Control: Behavior of the
elevation prompt for standard users.

4. From the drop-down menu, select one of the following settings:

• No prompt

• Prompt for credentials (this setting requires user name and password input
before an application or task will run as elevated, and is the default for
standard users)

• Prompt for consent (this is the default setting for administrators only)


5. Click OK.

6. Close the Local Security Settings window.


http://technet2.microsoft.com/Window....mspx?mfr=true



--
Gistcheckin


"Sam" wrote:

> I looked at the two URLS that you offered me and I didn't see anything that
> told me clearly and specifically what to do to accomplish what I want to do.
> I have a home network with no Active Directory Domain.
>
> Maybe I am slow, but I posed specific authorizations and/or polices that I
> wanted in place and I didn't see anything that showed my how to created a
> user that could download files, install programs and change his password -
> yet NOT be about to change other peoples passwords and change and/or remove
> the parental controls.
>
> Can you please break it down to the basic steps?
> What happened to the concept of the Power Users group?
>
> Still stumped...
> Sam
> Software Quality Assurance (SQA) Engineer
>
>
>
> "Ronnie Vernon MVP" wrote:
>
> > Sam
> >
> > With Vista Ultimate you have the resources provided by the Group Policy
> > (gpedit.msc) and the Security Policy (SecPol.msc) components.
> >
> > These tools can accomplish just about anything you need to open or lock down
> > any component in the system. It may take you a short time to learn, but it
> > is well worth the effort.
> >
> > Resources for Learning About Group Policy for Windows Vista:
> > http://technet2.microsoft.com/Window...0ef971033.mspx
> >
> > Download details: Group Policy Settings Reference:
> > http://www.microsoft.com/downloads/d...DisplayLang=en
> >
> > --
> >
> > Ronnie Vernon
> > Microsoft MVP
> > Windows Shell/User
> >
> >
> > "Sam" <Sam@discussions.microsoft.com> wrote in message
> > news:BCF32B12-C752-42F5-A274-BC8E6F3E7963@microsoft.com...
> > > My goal, when I bought a new Windows Vista Ultimate computer for my son's
> > > 8th
> > > grade graduation, was to give him a tool to do his high school research
> > > and
> > > homework, at the same time controlling the time that he spent on the
> > > computer
> > > playing games. He spent too much time playing online game in middle
> > > school
> > > and his grades suffered as a result.
> > >
> > > When I configured Windows Vista Ultimate, I setup myself as the Vista
> > > Administrator and set him up as a Vista Standard User. Then I enabled
> > > Parental Controls and set computer usage time limits.
> > >
> > > However, as a Windows Vista Ultimate Standard User, he cannot download
> > > research or other files from the internet and/or he cannot install any
> > > programs (educational or not).
> > >
> > > The bottom line is that I want give him all the rights of a Windows Vista
> > > Administrator, with the following exceptions:
> > > * I do not want to let him remove or modify the Parental Controls in any
> > > way
> > > * I do not want to let him change his own or other peoples privileges.
> > > * I do not want him to change other user's, like his sister, password,
> > > but
> > > he should be able to change his own password.
> > > * I do not want him to change the Windows Live OneCare firewall and other
> > > settings. Windows Live OneCare should block him from downloading and
> > > installing spyware or viruses.
> > >
> > > Can someone please tell me how to enable this in Windows Vista Ultimate?
> > >
> > > Thanks,
> > >
> > > Sam
> > > Software Quality Assurance (SQA) Engineer
> > >

> >

Reply With Quote
  #7 (permalink)  
Old 07-03-2007
Sam
 

Posts: n/a
Re: Standard Users Privileges
Hi Gistcheckin,

Thanks for the detailed advice! I will try it as soon as i go home tonight.

Will adding the users to the newly configured Power Users group still limit
them from changing the Parental Controls? If not, how can I specify that
policy for the Power Users group?

Thanks,
Sam M.
Software Quality Assurance (SQA) Engineer


"Gistcheckin" wrote:

> Migrating from the Power Users Group
> The Power Users group in Windows XP was designed to enable members of the
> group to perform system tasks, such as installing applications without
> granting full administrator permissions. Power Users also had write access to
> areas of the file system and registry that normally only allow administrator
> access. Power Users enabled some level of application compatibility;
> unfortunately, this did not address a fundamental problem: applications
> requiring unnecessary privileges and user rights. UAC does not leverage the
> Power Users group, and the permissions granted to the Power Users group on
> Windows XP have been removed from Windows Vista. UAC enables standard users
> to perform all common configuration tasks. The Power Users group, however, is
> still available for backwards compatibility with other versions of Windows.
> To use the Power Users group on Windows Vista, a new security template must
> be applied to change the default permissions on system folders and the
> registry to grant Power Users group permissions equivalent to Windows XP.
>
> To disable UAC from prompting for credentials to install applications
>
> 1. Click Start, click All Programs, click Accessories, click Run, type
> secpol.msc in the Open text box, and then click OK.
>
> 2. From the Local Security Settings console tree, click Local Policies, and
> then Security Options.
>
> 3. Scroll down and double-click User Account Control: Detect application
> installations and prompt for elevation.
>
> 4. From the User Account Control: Detect application installations and
> prompt for elevation Properties dialog box, click Disabled, and then click OK.
>
> 5. Close the Local Security Settings window.
>
>
> To change the elevation prompt behavior
>
> 1. Click Start, click Accessories, click Run, type secpol.msc in the Open
> text box, and then click OK.
>
> 2. From the Local Security Settings console tree, click Local Policies, and
> then Security Options.
>
> 3. Scroll down to and double-click User Account Control: Behavior of the
> elevation prompt for administrators or User Account Control: Behavior of the
> elevation prompt for standard users.
>
> 4. From the drop-down menu, select one of the following settings:
>
> • No prompt
>
> • Prompt for credentials (this setting requires user name and password input
> before an application or task will run as elevated, and is the default for
> standard users)
>
> • Prompt for consent (this is the default setting for administrators only)
>
>
> 5. Click OK.
>
> 6. Close the Local Security Settings window.
>
>
> http://technet2.microsoft.com/Window....mspx?mfr=true
>
>
>
> --
> Gistcheckin
>
>
> "Sam" wrote:
>
> > I looked at the two URLS that you offered me and I didn't see anything that
> > told me clearly and specifically what to do to accomplish what I want to do.
> > I have a home network with no Active Directory Domain.
> >
> > Maybe I am slow, but I posed specific authorizations and/or polices that I
> > wanted in place and I didn't see anything that showed my how to created a
> > user that could download files, install programs and change his password -
> > yet NOT be about to change other peoples passwords and change and/or remove
> > the parental controls.
> >
> > Can you please break it down to the basic steps?
> > What happened to the concept of the Power Users group?
> >
> > Still stumped...
> > Sam
> > Software Quality Assurance (SQA) Engineer
> >
> >
> >
> > "Ronnie Vernon MVP" wrote:
> >
> > > Sam
> > >
> > > With Vista Ultimate you have the resources provided by the Group Policy
> > > (gpedit.msc) and the Security Policy (SecPol.msc) components.
> > >
> > > These tools can accomplish just about anything you need to open or lock down
> > > any component in the system. It may take you a short time to learn, but it
> > > is well worth the effort.
> > >
> > > Resources for Learning About Group Policy for Windows Vista:
> > > http://technet2.microsoft.com/Window...0ef971033.mspx
> > >
> > > Download details: Group Policy Settings Reference:
> > > http://www.microsoft.com/downloads/d...DisplayLang=en
> > >
> > > --
> > >
> > > Ronnie Vernon
> > > Microsoft MVP
> > > Windows Shell/User
> > >
> > >
> > > "Sam" <Sam@discussions.microsoft.com> wrote in message
> > > news:BCF32B12-C752-42F5-A274-BC8E6F3E7963@microsoft.com...
> > > > My goal, when I bought a new Windows Vista Ultimate computer for my son's
> > > > 8th
> > > > grade graduation, was to give him a tool to do his high school research
> > > > and
> > > > homework, at the same time controlling the time that he spent on the
> > > > computer
> > > > playing games. He spent too much time playing online game in middle
> > > > school
> > > > and his grades suffered as a result.
> > > >
> > > > When I configured Windows Vista Ultimate, I setup myself as the Vista
> > > > Administrator and set him up as a Vista Standard User. Then I enabled
> > > > Parental Controls and set computer usage time limits.
> > > >
> > > > However, as a Windows Vista Ultimate Standard User, he cannot download
> > > > research or other files from the internet and/or he cannot install any
> > > > programs (educational or not).
> > > >
> > > > The bottom line is that I want give him all the rights of a Windows Vista
> > > > Administrator, with the following exceptions:
> > > > * I do not want to let him remove or modify the Parental Controls in any
> > > > way
> > > > * I do not want to let him change his own or other peoples privileges.
> > > > * I do not want him to change other user's, like his sister, password,
> > > > but
> > > > he should be able to change his own password.
> > > > * I do not want him to change the Windows Live OneCare firewall and other
> > > > settings. Windows Live OneCare should block him from downloading and
> > > > installing spyware or viruses.
> > > >
> > > > Can someone please tell me how to enable this in Windows Vista Ultimate?
> > > >
> > > > Thanks,
> > > >
> > > > Sam
> > > > Software Quality Assurance (SQA) Engineer
> > > >
> > >

Reply With Quote
  #8 (permalink)  
Old 07-04-2007
Sam
 

Posts: n/a
Re: Standard Users Privileges
I implemented your solution and it allowed a standard user to download and
install files like i wanted.

However, it also allowed the standard user to change the Parental Controls,
like I did NOT want.

Is there any way do enable a policy that does exactly what i requested?
Basically, I need to create "an administrator with limited rights"
--
Sam M.
Software Quality Assurance (SQA) Engineer



"Gistcheckin" wrote:

> Migrating from the Power Users Group
> The Power Users group in Windows XP was designed to enable members of the
> group to perform system tasks, such as installing applications without
> granting full administrator permissions. Power Users also had write access to
> areas of the file system and registry that normally only allow administrator
> access. Power Users enabled some level of application compatibility;
> unfortunately, this did not address a fundamental problem: applications
> requiring unnecessary privileges and user rights. UAC does not leverage the
> Power Users group, and the permissions granted to the Power Users group on
> Windows XP have been removed from Windows Vista. UAC enables standard users
> to perform all common configuration tasks. The Power Users group, however, is
> still available for backwards compatibility with other versions of Windows.
> To use the Power Users group on Windows Vista, a new security template must
> be applied to change the default permissions on system folders and the
> registry to grant Power Users group permissions equivalent to Windows XP.
>
> To disable UAC from prompting for credentials to install applications
>
> 1. Click Start, click All Programs, click Accessories, click Run, type
> secpol.msc in the Open text box, and then click OK.
>
> 2. From the Local Security Settings console tree, click Local Policies, and
> then Security Options.
>
> 3. Scroll down and double-click User Account Control: Detect application
> installations and prompt for elevation.
>
> 4. From the User Account Control: Detect application installations and
> prompt for elevation Properties dialog box, click Disabled, and then click OK.
>
> 5. Close the Local Security Settings window.
>
>
> To change the elevation prompt behavior
>
> 1. Click Start, click Accessories, click Run, type secpol.msc in the Open
> text box, and then click OK.
>
> 2. From the Local Security Settings console tree, click Local Policies, and
> then Security Options.
>
> 3. Scroll down to and double-click User Account Control: Behavior of the
> elevation prompt for administrators or User Account Control: Behavior of the
> elevation prompt for standard users.
>
> 4. From the drop-down menu, select one of the following settings:
>
> • No prompt
>
> • Prompt for credentials (this setting requires user name and password input
> before an application or task will run as elevated, and is the default for
> standard users)
>
> • Prompt for consent (this is the default setting for administrators only)
>
>
> 5. Click OK.
>
> 6. Close the Local Security Settings window.
>
>
> http://technet2.microsoft.com/Window....mspx?mfr=true
>
>
>
> --
> Gistcheckin
>
>
> "Sam" wrote:
>
> > I looked at the two URLS that you offered me and I didn't see anything that
> > told me clearly and specifically what to do to accomplish what I want to do.
> > I have a home network with no Active Directory Domain.
> >
> > Maybe I am slow, but I posed specific authorizations and/or polices that I
> > wanted in place and I didn't see anything that showed my how to created a
> > user that could download files, install programs and change his password -
> > yet NOT be about to change other peoples passwords and change and/or remove
> > the parental controls.
> >
> > Can you please break it down to the basic steps?
> > What happened to the concept of the Power Users group?
> >
> > Still stumped...
> > Sam
> > Software Quality Assurance (SQA) Engineer
> >
> >
> >
> > "Ronnie Vernon MVP" wrote:
> >
> > > Sam
> > >
> > > With Vista Ultimate you have the resources provided by the Group Policy
> > > (gpedit.msc) and the Security Policy (SecPol.msc) components.
> > >
> > > These tools can accomplish just about anything you need to open or lock down
> > > any component in the system. It may take you a short time to learn, but it
> > > is well worth the effort.
> > >
> > > Resources for Learning About Group Policy for Windows Vista:
> > > http://technet2.microsoft.com/Window...0ef971033.mspx
> > >
> > > Download details: Group Policy Settings Reference:
> > > http://www.microsoft.com/downloads/d...DisplayLang=en
> > >
> > > --
> > >
> > > Ronnie Vernon
> > > Microsoft MVP
> > > Windows Shell/User
> > >
> > >
> > > "Sam" <Sam@discussions.microsoft.com> wrote in message
> > > news:BCF32B12-C752-42F5-A274-BC8E6F3E7963@microsoft.com...
> > > > My goal, when I bought a new Windows Vista Ultimate computer for my son's
> > > > 8th
> > > > grade graduation, was to give him a tool to do his high school research
> > > > and
> > > > homework, at the same time controlling the time that he spent on the
> > > > computer
> > > > playing games. He spent too much time playing online game in middle
> > > > school
> > > > and his grades suffered as a result.
> > > >
> > > > When I configured Windows Vista Ultimate, I setup myself as the Vista
> > > > Administrator and set him up as a Vista Standard User. Then I enabled
> > > > Parental Controls and set computer usage time limits.
> > > >
> > > > However, as a Windows Vista Ultimate Standard User, he cannot download
> > > > research or other files from the internet and/or he cannot install any
> > > > programs (educational or not).
> > > >
> > > > The bottom line is that I want give him all the rights of a Windows Vista
> > > > Administrator, with the following exceptions:
> > > > * I do not want to let him remove or modify the Parental Controls in any
> > > > way
> > > > * I do not want to let him change his own or other peoples privileges.
> > > > * I do not want him to change other user's, like his sister, password,
> > > > but
> > > > he should be able to change his own password.
> > > > * I do not want him to change the Windows Live OneCare firewall and other
> > > > settings. Windows Live OneCare should block him from downloading and
> > > > installing spyware or viruses.
> > > >
> > > > Can someone please tell me how to enable this in Windows Vista Ultimate?
> > > >
> > > > Thanks,
> > > >
> > > > Sam
> > > > Software Quality Assurance (SQA) Engineer
> > > >
> > >

Reply With Quote
  #9 (permalink)  
Old 07-04-2007
Gistcheckin
 

Posts: n/a
Re: Standard Users Privileges
I believe you can restrict the User's Rights
http://technet2.microsoft.com/window....mspx?mfr=true

User rights
http://technet2.microsoft.com/window....mspx?mfr=true

--
Gistcheckin


"Sam" wrote:

> I implemented your solution and it allowed a standard user to download and
> install files like i wanted.
>
> However, it also allowed the standard user to change the Parental Controls,
> like I did NOT want.
>
> Is there any way do enable a policy that does exactly what i requested?
> Basically, I need to create "an administrator with limited rights"
> --
> Sam M.
> Software Quality Assurance (SQA) Engineer
>
>
>
> "Gistcheckin" wrote:
>
> > Migrating from the Power Users Group
> > The Power Users group in Windows XP was designed to enable members of the
> > group to perform system tasks, such as installing applications without
> > granting full administrator permissions. Power Users also had write access to
> > areas of the file system and registry that normally only allow administrator
> > access. Power Users enabled some level of application compatibility;
> > unfortunately, this did not address a fundamental problem: applications
> > requiring unnecessary privileges and user rights. UAC does not leverage the
> > Power Users group, and the permissions granted to the Power Users group on
> > Windows XP have been removed from Windows Vista. UAC enables standard users
> > to perform all common configuration tasks. The Power Users group, however, is
> > still available for backwards compatibility with other versions of Windows.
> > To use the Power Users group on Windows Vista, a new security template must
> > be applied to change the default permissions on system folders and the
> > registry to grant Power Users group permissions equivalent to Windows XP.
> >
> > To disable UAC from prompting for credentials to install applications
> >
> > 1. Click Start, click All Programs, click Accessories, click Run, type
> > secpol.msc in the Open text box, and then click OK.
> >
> > 2. From the Local Security Settings console tree, click Local Policies, and
> > then Security Options.
> >
> > 3. Scroll down and double-click User Account Control: Detect application
> > installations and prompt for elevation.
> >
> > 4. From the User Account Control: Detect application installations and
> > prompt for elevation Properties dialog box, click Disabled, and then click OK.
> >
> > 5. Close the Local Security Settings window.
> >
> >
> > To change the elevation prompt behavior
> >
> > 1. Click Start, click Accessories, click Run, type secpol.msc in the Open
> > text box, and then click OK.
> >
> > 2. From the Local Security Settings console tree, click Local Policies, and
> > then Security Options.
> >
> > 3. Scroll down to and double-click User Account Control: Behavior of the
> > elevation prompt for administrators or User Account Control: Behavior of the
> > elevation prompt for standard users.
> >
> > 4. From the drop-down menu, select one of the following settings:
> >
> > • No prompt
> >
> > • Prompt for credentials (this setting requires user name and password input
> > before an application or task will run as elevated, and is the default for
> > standard users)
> >
> > • Prompt for consent (this is the default setting for administrators only)
> >
> >
> > 5. Click OK.
> >
> > 6. Close the Local Security Settings window.
> >
> >
> > http://technet2.microsoft.com/Window....mspx?mfr=true
> >
> >
> >
> > --
> > Gistcheckin
> >
> >
> > "Sam" wrote:
> >
> > > I looked at the two URLS that you offered me and I didn't see anything that
> > > told me clearly and specifically what to do to accomplish what I want to do.
> > > I have a home network with no Active Directory Domain.
> > >
> > > Maybe I am slow, but I posed specific authorizations and/or polices that I
> > > wanted in place and I didn't see anything that showed my how to created a
> > > user that could download files, install programs and change his password -
> > > yet NOT be about to change other peoples passwords and change and/or remove
> > > the parental controls.
> > >
> > > Can you please break it down to the basic steps?
> > > What happened to the concept of the Power Users group?
> > >
> > > Still stumped...
> > > Sam
> > > Software Quality Assurance (SQA) Engineer
> > >
> > >
> > >
> > > "Ronnie Vernon MVP" wrote:
> > >
> > > > Sam
> > > >
> > > > With Vista Ultimate you have the resources provided by the Group Policy
> > > > (gpedit.msc) and the Security Policy (SecPol.msc) components.
> > > >
> > > > These tools can accomplish just about anything you need to open or lock down
> > > > any component in the system. It may take you a short time to learn, but it
> > > > is well worth the effort.
> > > >
> > > > Resources for Learning About Group Policy for Windows Vista:
> > > > http://technet2.microsoft.com/Window...0ef971033.mspx
> > > >
> > > > Download details: Group Policy Settings Reference:
> > > > http://www.microsoft.com/downloads/d...DisplayLang=en
> > > >
> > > > --
> > > >
> > > > Ronnie Vernon
> > > > Microsoft MVP
> > > > Windows Shell/User
> > > >
> > > >
> > > > "Sam" <Sam@discussions.microsoft.com> wrote in message
> > > > news:BCF32B12-C752-42F5-A274-BC8E6F3E7963@microsoft.com...
> > > > > My goal, when I bought a new Windows Vista Ultimate computer for my son's
> > > > > 8th
> > > > > grade graduation, was to give him a tool to do his high school research
> > > > > and
> > > > > homework, at the same time controlling the time that he spent on the
> > > > > computer
> > > > > playing games. He spent too much time playing online game in middle
> > > > > school
> > > > > and his grades suffered as a result.
> > > > >
> > > > > When I configured Windows Vista Ultimate, I setup myself as the Vista
> > > > > Administrator and set him up as a Vista Standard User. Then I enabled
> > > > > Parental Controls and set computer usage time limits.
> > > > >
> > > > > However, as a Windows Vista Ultimate Standard User, he cannot download
> > > > > research or other files from the internet and/or he cannot install any
> > > > > programs (educational or not).
> > > > >
> > > > > The bottom line is that I want give him all the rights of a Windows Vista
> > > > > Administrator, with the following exceptions:
> > > > > * I do not want to let him remove or modify the Parental Controls in any
> > > > > way
> > > > > * I do not want to let him change his own or other peoples privileges.
> > > > > * I do not want him to change other user's, like his sister, password,
> > > > > but
> > > > > he should be able to change his own password.
> > > > > * I do not want him to change the Windows Live OneCare firewall and other
> > > > > settings. Windows Live OneCare should block him from downloading and
> > > > > installing spyware or viruses.
> > > > >
> > > > > Can someone please tell me how to enable this in Windows Vista Ultimate?
> > > > >
> > > > > Thanks,
> > > > >
> > > > > Sam
> > > > > Software Quality Assurance (SQA) Engineer
> > > > >
> > > >

Reply With Quote
  #10 (permalink)  
Old 07-04-2007
Sam
 

Posts: n/a
Re: Standard Users Privileges
Yes, but which is the user rights policy that states you can not change
Parental Controls?

I did not see the words, "Parental Controls" in either of the links that you
provided.

I'm beginning to think that Windows Vista Utimate is not the answer to my
wishes.
I don't think that Net Nanny, from what i read, is the answer either. If my
kids can elevate themselves to administrators, they can turn off Parental
Controls or disable Net Nanny.

I can set time limits on my Linksys router but not on a per user basis -
everyone would be affected by router time limits.

--
Sam M.
Software Quality Assurance (SQA) Engineer


"Gistcheckin" wrote:

> I believe you can restrict the User's Rights
> http://technet2.microsoft.com/window....mspx?mfr=true
>
> User rights
> http://technet2.microsoft.com/window....mspx?mfr=true
>
> --
> Gistcheckin
>
>
> "Sam" wrote:
>
> > I implemented your solution and it allowed a standard user to download and
> > install files like i wanted.
> >
> > However, it also allowed the standard user to change the Parental Controls,
> > like I did NOT want.
> >
> > Is there any way do enable a policy that does exactly what i requested?
> > Basically, I need to create "an administrator with limited rights"
> > --
> > Sam M.
> > Software Quality Assurance (SQA) Engineer
> >
> >
> >
> > "Gistcheckin" wrote:
> >
> > > Migrating from the Power Users Group
> > > The Power Users group in Windows XP was designed to enable members of the
> > > group to perform system tasks, such as installing applications without
> > > granting full administrator permissions. Power Users also had write access to
> > > areas of the file system and registry that normally only allow administrator
> > > access. Power Users enabled some level of application compatibility;
> > > unfortunately, this did not address a fundamental problem: applications
> > > requiring unnecessary privileges and user rights. UAC does not leverage the
> > > Power Users group, and the permissions granted to the Power Users group on
> > > Windows XP have been removed from Windows Vista. UAC enables standard users
> > > to perform all common configuration tasks. The Power Users group, however, is
> > > still available for backwards compatibility with other versions of Windows.
> > > To use the Power Users group on Windows Vista, a new security template must
> > > be applied to change the default permissions on system folders and the
> > > registry to grant Power Users group permissions equivalent to Windows XP.
> > >
> > > To disable UAC from prompting for credentials to install applications
> > >
> > > 1. Click Start, click All Programs, click Accessories, click Run, type
> > > secpol.msc in the Open text box, and then click OK.
> > >
> > > 2. From the Local Security Settings console tree, click Local Policies, and
> > > then Security Options.
> > >
> > > 3. Scroll down and double-click User Account Control: Detect application
> > > installations and prompt for elevation.
> > >
> > > 4. From the User Account Control: Detect application installations and
> > > prompt for elevation Properties dialog box, click Disabled, and then click OK.
> > >
> > > 5. Close the Local Security Settings window.
> > >
> > >
> > > To change the elevation prompt behavior
> > >
> > > 1. Click Start, click Accessories, click Run, type secpol.msc in the Open
> > > text box, and then click OK.
> > >
> > > 2. From the Local Security Settings console tree, click Local Policies, and
> > > then Security Options.
> > >
> > > 3. Scroll down to and double-click User Account Control: Behavior of the
> > > elevation prompt for administrators or User Account Control: Behavior of the
> > > elevation prompt for standard users.
> > >
> > > 4. From the drop-down menu, select one of the following settings:
> > >
> > > • No prompt
> > >
> > > • Prompt for credentials (this setting requires user name and password input
> > > before an application or task will run as elevated, and is the default for
> > > standard users)
> > >
> > > • Prompt for consent (this is the default setting for administrators only)
> > >
> > >
> > > 5. Click OK.
> > >
> > > 6. Close the Local Security Settings window.
> > >
> > >
> > > http://technet2.microsoft.com/Window....mspx?mfr=true
> > >
> > >
> > >
> > > --
> > > Gistcheckin
> > >
> > >
> > > "Sam" wrote:
> > >
> > > > I looked at the two URLS that you offered me and I didn't see anything that
> > > > told me clearly and specifically what to do to accomplish what I want to do.
> > > > I have a home network with no Active Directory Domain.
> > > >
> > > > Maybe I am slow, but I posed specific authorizations and/or polices that I
> > > > wanted in place and I didn't see anything that showed my how to created a
> > > > user that could download files, install programs and change his password -
> > > > yet NOT be about to change other peoples passwords and change and/or remove
> > > > the parental controls.
> > > >
> > > > Can you please break it down to the basic steps?
> > > > What happened to the concept of the Power Users group?
> > > >
> > > > Still stumped...
> > > > Sam
> > > > Software Quality Assurance (SQA) Engineer
> > > >
> > > >
> > > >
> > > > "Ronnie Vernon MVP" wrote:
> > > >
> > > > > Sam
> > > > >
> > > > > With Vista Ultimate you have the resources provided by the Group Policy
> > > > > (gpedit.msc) and the Security Policy (SecPol.msc) components.
> > > > >
> > > > > These tools can accomplish just about anything you need to open or lock down
> > > > > any component in the system. It may take you a short time to learn, but it
> > > > > is well worth the effort.
> > > > >
> > > > > Resources for Learning About Group Policy for Windows Vista:
> > > > > http://technet2.microsoft.com/Window...0ef971033.mspx
> > > > >
> > > > > Download details: Group Policy Settings Reference:
> > > > > http://www.microsoft.com/downloads/d...DisplayLang=en
> > > > >
> > > > > --
> > > > >
> > > > > Ronnie Vernon
> > > > > Microsoft MVP
> > > > > Windows Shell/User
> > > > >
> > > > >
> > > > > "Sam" <Sam@discussions.microsoft.com> wrote in message
> > > > > news:BCF32B12-C752-42F5-A274-BC8E6F3E7963@microsoft.com...
> > > > > > My goal, when I bought a new Windows Vista Ultimate computer for my son's
> > > > > > 8th
> > > > > > grade graduation, was to give him a tool to do his high school research
> > > > > > and
> > > > > > homework, at the same time controlling the time that he spent on the
> > > > > > computer
> > > > > > playing games. He spent too much time playing online game in middle
> > > > > > school
> > > > > > and his grades suffered as a result.
> > > > > >
> > > > > > When I configured Windows Vista Ultimate, I setup myself as the Vista
> > > > > > Administrator and set him up as a Vista Standard User. Then I enabled
> > > > > > Parental Controls and set computer usage time limits.
> > > > > >
> > > > > > However, as a Windows Vista Ultimate Standard User, he cannot download
> > > > > > research or other files from the internet and/or he cannot install any
> > > > > > programs (educational or not).
> > > > > >
> > > > > > The bottom line is that I want give him all the rights of a Windows Vista
> > > > > > Administrator, with the following exceptions:
> > > > > > * I do not want to let him remove or modify the Parental Controls in any
> > > > > > way
> > > > > > * I do not want to let him change his own or other peoples privileges.
> > > > > > * I do not want him to change other user's, like his sister, password,
> > > > > > but
> > > > > > he should be able to change his own password.
> > > > > > * I do not want him to change the Windows Live OneCare firewall and other
> > > > > > settings. Windows Live OneCare should block him from downloading and
> > > > > > installing spyware or viruses.
> > > > > >
> > > > > > Can someone please tell me how to enable this in Windows Vista Ultimate?
> > > > > >
> > > > > > Thanks,
> > > > > >
> > > > > > Sam
> > > > > > Software Quality Assurance (SQA) Engineer
> > > > > >
> > > > >

Reply With Quote
Reply


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
BeyondTrust keep Windows users from abusing privileges Paul Security News 0 06-28-2007 18:33
adding certain priveledges to standard users Heidi H. microsoft.public.windows.vista.administration accounts passwords 1 06-22-2007 05:07
Hiding a folder for standard users only...is this possible? Acher microsoft.public.windows.vista.security 2 05-06-2007 11:12
Admin Rights and Standard Users Riley microsoft.public.windows.vista.administration accounts passwords 0 05-02-2007 00:18
McAfee Virex 'VShieldExclude.txt' File Symlink Flaw Lets Local Users Obtain Root Privileges Paul Security News 0 03-01-2007 10:53




All times are GMT +1. The time now is 00:40.




Driver Scanner - Free Scan Now

Vistaheads.com is part of the Heads Network. See also XPHeads.com , Win7Heads.com and Win8Heads.com.


Design by Vjacheslav Trushkin for phpBBStyles.com.
Powered by vBulletin® Version 3.6.7
Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Search Engine Optimization by vBSEO 3.6.0 RC 2

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120