Windwos XP Administrator Rights Tweaking

I am using Win XP SP2. I have two user accounts.
One for Administrator purpose and another of Power user.
I have problem using Power account for some software.
I want Power user account all the rights of Administrator user
except of Disk Format Right. i.e. Power user should not
be able to format the hard disk. Is it possible?
Where can I find more info for defining other Windows rights creation on net?
Can I get tutorial for that? any info will be welcome.
i.e. in our Comp lab the admin disables some tabs in IE (you can not change home page)
Thanks.
LVL 1
matrix123Asked:
Who is Participating?
 
gonzal13RetiredCommented:
http://support.microsoft.com/default.aspx?scid=kb;en-us;825069

A member of the Power Users group may be able to gain administrator rights and permissions in Windows Server 2003, Windows 2000, or Windows XP

http://search.support.microsoft.com/search/?adv=1

Microsoft Data Base


gonzal13(joe)
0
 
NetworkArchitekCommented:
Hi matrix123,
Yes, using group policy. Although for a single workstation what you can do is very, very limited. You can basically lockdown everyone except the Administrator group, you cannot go group level security, really. You can do this though.

Start>Run>MMC. Use File to "Add" a snap-in, from there click "add" and find "Group Policy" add that for the local computer. In there go to User Configuration>Administrative Templates. From here you can do many things. To keep this from applying to the administrator you need to change security permissions of c:\windows\system32\GroupPolicy to deny "Read" access to the administrators. If you need to edit the group policy later you need to temporarily suspend this denial long enough to edit it.

ALTERNATIVELY: If you only want to prevent them from formatting, including floppies through the command line, you can do this. Do a search for *.msc. Now change the permissions for diskmgmt.msc to deny read access for the Power Users and do the same for compmgmt.msc. If you want them to be able to use the MMC you will need to make them customized ones which don't have Disk Management. Now locate format.com and do the same. This will do exactly what you want to do without the trouble of what I said before.
Cheers!
0
 
matrix123Author Commented:
Thanks network
 I think there is some misunderstanding.
 1. I want Floppy disk to be formatted for Power user having all Administrator rights except
 formatting only "Hard Disk" . According to you if i deny access for format.com for power user i can
 not format Floppy.

 2. Secondly in Security Tab for these files c:\windows\system32\GroupPolicy, compmgmt.msc, format.com, compmgmt.msc , there is "Administrators" group is already have full control.

 3. According to me if i want to create user as per my question then i will be adding user "matrix" having
 "Administrators" group and also "Power User" group. Then "matrix" already have full control assuming 2nd point. In that case it wont work for me.

 4. I think in order to prevent this i will have to delete "Administrators" group in second case and add simple "Administrator" user and give full control to him and deny it to "matrix' user. is it right?

note that "Administrator" and "Administrators" are different. you know it.
also what to make them customized ones which don't have Disk Management ?. I will be thankful if you can explain little bit about it or any web resource.
also in MMC console where is policy for Formatting HDD, Floppy.
 bye.
0
 
gonzal13RetiredCommented:
1. I want Floppy disk to be formatted for Power user having all Administrator rights except
 formatting only "Hard Disk" . According to you if i deny access for format.com for power user i can
 not format Floppy.

Floppies come formatted from the box
To easily prevent formatting, just find the format command and rename it RenFormat.com

gonzal13(joe)
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.