Microsoft Windows Vista Community Forums - Vistaheads
Recommended Download



Welcome to the Microsoft Windows Vista Community Forums - Vistaheads, YOUR Largest Resource for Windows Vista related information.

You are currently viewing our boards as a guest which gives you limited access to view most discussions and access our other features. By joining our free community you will have access to post topics, communicate privately with other members (PM), respond to polls, upload content and access many other special features. Registration is fast, simple and absolutely free so , join our community today!

If you have any problems with the registration process or your account login, please contact us.

Driver Scanner

Can a standard user access the Admin account via Safe Mode?

microsoft.public.windows.vista.security






Speedup My PC
Reply
  #1 (permalink)  
Old 11-09-2008
mgr
 

Posts: n/a
Can a standard user access the Admin account via Safe Mode?

I have a situation where I want to be the administrator for my son's
laptop, and convert him to a standard (non-admin) account. He originally
set up the laptop, giving himself admin privileges, but he is no longer
allowed to use it in that condition

I am now the passworded local admin account (same account used to
install Vista), and AFAIK do not have the system Administrator
(upper-case A) account activated. He has a "standard" account. However,
he is clever, and will try to work-around to get admin access. I've read
the "recover password / activate Admin /etc." links in the forum, and I
have a few questions:

1. Can my local admin account OR the system Admin account be accessed
and altered by a standard user in Safe Mode?

2. Is it possible to block Method 3 (DVD boot for password reset) if
the system is already properly set up for one admin's access?

3. I do not see the "user groups" folder in Comp Mmgt Control Panel to
enable or disable the system Admin account. How can I check its status?

BTW, I'm using Vista Home Basic.

Thanks,
mgr


--
mgr
Reply With Quote
Sponsored Links
  #2 (permalink)  
Old 11-09-2008
barman58
 

Posts: n/a
Re: Can a standard user access the Admin account via Safe Mode?

Hello Mgr and welcome to the vista forums arty:

First thing you may want to check is vista's built-in parental controls
...

'Explore the features: Parental controls'
(http://www.microsoft.com/windows/win...-controls.aspx)

which should allow you to set limits for any standard account from your
administrator account.

as for the booting of a password reset cd or dvd which cannot be
controlled from vista as it boots before vista does, the only way I can
advise is this.

go into the BIOS of the laptop and either remove the cd drive from the
boot devices or set it to after the hard drive. that will stop anyone
gaining access to the drive before vista boots. you should then be able
to password protect the changing of the BIOS with a password Not
foolproof - I have professional software that can defeat this but it is
not generally available


If you need to boot from a CD/DVD yourself it is a fairly simple matter
to log into the BIOS change the setting and reboot

hope this helps ...


--
barman58

Regards,
*Nigel*
the beginning of knowledge is the discovery of something we do not
understand.,- frank herbert
Reply With Quote
  #3 (permalink)  
Old 11-09-2008
FromTheRafters
 

Posts: n/a
Re: Can a standard user access the Admin account via Safe Mode?

"mgr" <guest@unknown-email.com> wrote in message
news:4decb1bab7b24203b8b99d370510f94b@nntp-gateway.com...
>
> I have a situation where I want to be the administrator for my son's
> laptop, and convert him to a standard (non-admin) account. He originally
> set up the laptop, giving himself admin privileges, but he is no longer
> allowed to use it in that condition
>
> I am now the passworded local admin account (same account used to
> install Vista),


Not really, that account was created afterward.

> and AFAIK do not have the system Administrator
> (upper-case A) account activated. He has a "standard" account. However,
> he is clever, and will try to work-around to get admin access.


Activate and create a password for the *real* administrator, then
deactivate it again. That way he won't be able to easily access that
account.

> I've read
> the "recover password / activate Admin /etc." links in the forum, and I
> have a few questions:
>
> 1. Can my local admin account OR the system Admin account be accessed
> and altered by a standard user in Safe Mode?


It shouldn't be possible.

> 2. Is it possible to block Method 3 (DVD boot for password reset) if
> the system is already properly set up for one admin's access?


Disable or resequence the CD/DVD boot option in the CMOS and
apply a password to the CMOS to make it more difficult to modify.

> 3. I do not see the "user groups" folder in Comp Mmgt Control Panel to
> enable or disable the system Admin account. How can I check its status?


Type "net user Administrator" at the command prompt.

Type "net help user|more" at the command prompt for usage of the
net user command switches and options.



Reply With Quote
  #4 (permalink)  
Old 11-12-2008
mgr
 

Posts: n/a
Re: Can a standard user access the Admin account via Safe Mode?

All,

Appreciate the informative replies. Looks like I have a number of
options to prevent workarounds. I'm _-hoping_- I don't have to do any of
these yet.

I'm still curious about that first established account, though. It's
true the account didn't exist until we got the laptop (as Vista was
already installed) but I've read that any changes to that first account
(e.g. changing it from an admin to standard and creating a new admin)
can create serious problems. Are people really referring to the system
Admin account in these situations?

Thanks,
mgr


--
mgr
Reply With Quote
  #5 (permalink)  
Old 11-12-2008
FromTheRafters
 

Posts: n/a
Re: Can a standard user access the Admin account via Safe Mode?
"mgr" <guest@unknown-email.com> wrote in message
news:8cebcfb932676e6ba49f413724d4f087@nntp-gateway.com...
>
> All,
>
> Appreciate the informative replies. Looks like I have a number of
> options to prevent workarounds. I'm _-hoping_- I don't have to do any of
> these yet.
>
> I'm still curious about that first established account, though. It's
> true the account didn't exist until we got the laptop (as Vista was
> already installed) but I've read that any changes to that first account
> (e.g. changing it from an admin to standard and creating a new admin)
> can create serious problems. Are people really referring to the system
> Admin account in these situations?


When Vista sets up, it creates the "Administrator" account. After that
it sets up the split token user/administrator account and disables the
"Administrator" account and hides it from the user.

The user/administrator is then prompted to create other standard user
accounts as desired. If for any reason the last available account with
administrator privileges is demoted or deleted - the OS should enable
the "Administrator" account and make it available in safe mode.

Unfortunately, it is possible to give the ASP.NET account administrator
privileges and then demote or delete all other accounts without the OS
enabling "Administrator". To the OS there is still an administrator level
account - the problem then is the access to that account.


Reply With Quote
  #6 (permalink)  
Old 11-12-2008
barman58
 

Posts: n/a
Re: Can a standard user access the Admin account via Safe Mode?

Hi mgr,

There is confusion as to when the FULL Administrator account is
available in vista.

of course it may be enabled using the NET USER command and will then
appear in the log-in (by default with no password ).

In XP when you entered Safe Mode you were automatically logged in as
the FULL administrator this is NOT the default for Vista. If however
there are no administrator accounts set-up in Vista then it is supposed
to revert to the XP system (as a fall-back to prevent lockout). I say
"supposed" as I have seen lockouts where re-install was the only remedy.

As for the first account created by the user in vista this is by
default an administrator account but as far as I am aware this is not
"special" in any way.

This account may be removed, (by another later created administrator or
the FULL administrator account, but not if it's the only account on the
machine), and I believe it may also be downgraded to a standard user
even when it is the only administrator on the system, and this is why
the reversion to XP behaviour was included for safe mode.

Hope this helps ...


--
barman58

Regards,
*Nigel*
the beginning of knowledge is the discovery of something we do not
understand.,- frank herbert
Reply With Quote
  #7 (permalink)  
Old 11-12-2008
FromTheRafters
 

Posts: n/a
Re: Can a standard user access the Admin account via Safe Mode?
"barman58" <guest@unknown-email.com> wrote in message
news:0a563722690fa961418c09b21397d6a5@nntp-gateway.com...

> As for the first account created by the user in vista this is by
> default an administrator account but as far as I am aware this is not
> "special" in any way.


It is "special" in that it uses a split token (as opposed to the full
token in the *real* administrator account). The account runs as
a standard user until an action is requested that requires admin
privileges. It then will prompt the user to "consent" to using the
rest of the split token. They call this Admin Approval Mode or
AAM for short.

The same action requested in a regular standard user account
will prompt the user to supply administrator credentials before
allowing the action to take place.


Reply With Quote
  #8 (permalink)  
Old 11-14-2008
mgr
 

Posts: n/a
Re: Can a standard user access the Admin account via Safe Mode?

Nigel,

Thanks, that makes sense. Again, I appreciate the help.

mgr


--
mgr
Reply With Quote
Reply


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
Standard User account cannot see/access all programs Bethmurs microsoft.public.windows.vista.administration accounts passwords 2 03-17-2010 03:02
Admin access to password protected regular user account dad1234 microsoft.public.windows.vista.administration accounts passwords 2 06-25-2008 02:01
Can't access external drive with standard user account brain82 microsoft.public.windows.vista.networking sharing 2 05-18-2008 14:21
Cant find my standard user account files when logged in as Admin?? DarFromVa microsoft.public.windows.vista.administration accounts passwords 2 10-11-2007 05:10
Standard User works like admin account jcraig33 microsoft.public.windows.vista.administration accounts passwords 6 06-15-2007 03:17




All times are GMT +1. The time now is 12:35.




Driver Scanner - Free Scan Now

Vistaheads.com is part of the Heads Network. See also XPHeads.com , Win7Heads.com and Win8Heads.com.


Design by Vjacheslav Trushkin for phpBBStyles.com.
Powered by vBulletin® Version 3.6.7
Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Search Engine Optimization by vBSEO 3.6.0 RC 2

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120