Solved

Windwos XP Administrator Rights Tweaking

Posted on 2004-10-25
420 Views
Last Modified: 2008-01-09
I am using Win XP SP2. I have two user accounts.
One for Administrator purpose and another of Power user.
I have problem using Power account for some software.
I want Power user account all the rights of Administrator user
except of Disk Format Right. i.e. Power user should not
be able to format the hard disk. Is it possible?
Where can I find more info for defining other Windows rights creation on net?
Can I get tutorial for that? any info will be welcome.
i.e. in our Comp lab the admin disables some tabs in IE (you can not change home page)
Thanks.
0
Question by:matrix123
    4 Comments
     
    LVL 10

    Expert Comment

    by:NetworkArchitek
    Hi matrix123,
    Yes, using group policy. Although for a single workstation what you can do is very, very limited. You can basically lockdown everyone except the Administrator group, you cannot go group level security, really. You can do this though.

    Start>Run>MMC. Use File to "Add" a snap-in, from there click "add" and find "Group Policy" add that for the local computer. In there go to User Configuration>Administrative Templates. From here you can do many things. To keep this from applying to the administrator you need to change security permissions of c:\windows\system32\GroupPolicy to deny "Read" access to the administrators. If you need to edit the group policy later you need to temporarily suspend this denial long enough to edit it.

    ALTERNATIVELY: If you only want to prevent them from formatting, including floppies through the command line, you can do this. Do a search for *.msc. Now change the permissions for diskmgmt.msc to deny read access for the Power Users and do the same for compmgmt.msc. If you want them to be able to use the MMC you will need to make them customized ones which don't have Disk Management. Now locate format.com and do the same. This will do exactly what you want to do without the trouble of what I said before.
    Cheers!
    0
     
    LVL 1

    Author Comment

    by:matrix123
    Thanks network
     I think there is some misunderstanding.
     1. I want Floppy disk to be formatted for Power user having all Administrator rights except
     formatting only "Hard Disk" . According to you if i deny access for format.com for power user i can
     not format Floppy.

     2. Secondly in Security Tab for these files c:\windows\system32\GroupPolicy, compmgmt.msc, format.com, compmgmt.msc , there is "Administrators" group is already have full control.

     3. According to me if i want to create user as per my question then i will be adding user "matrix" having
     "Administrators" group and also "Power User" group. Then "matrix" already have full control assuming 2nd point. In that case it wont work for me.

     4. I think in order to prevent this i will have to delete "Administrators" group in second case and add simple "Administrator" user and give full control to him and deny it to "matrix' user. is it right?

    note that "Administrator" and "Administrators" are different. you know it.
    also what to make them customized ones which don't have Disk Management ?. I will be thankful if you can explain little bit about it or any web resource.
    also in MMC console where is policy for Formatting HDD, Floppy.
     bye.
    0
     
    LVL 13

    Expert Comment

    by:gonzal13
    1. I want Floppy disk to be formatted for Power user having all Administrator rights except
     formatting only "Hard Disk" . According to you if i deny access for format.com for power user i can
     not format Floppy.

    Floppies come formatted from the box
    To easily prevent formatting, just find the format command and rename it RenFormat.com

    gonzal13(joe)
    0
     
    LVL 13

    Accepted Solution

    by:
    http://support.microsoft.com/default.aspx?scid=kb;en-us;825069

    A member of the Power Users group may be able to gain administrator rights and permissions in Windows Server 2003, Windows 2000, or Windows XP

    http://search.support.microsoft.com/search/?adv=1

    Microsoft Data Base


    gonzal13(joe)
    0

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Do You Know the 4 Main Threat Actor Types?

    Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

    Suggested Solutions

    I don't know if many of you have made the great mistake of using the Cisco Thin Client model with the management software VXC. If you have then you are probably more then familiar with the incredibly clunky interface, the numerous work arounds, and …
    #Citrix #POC #XenDesktop #vCenter #VMware #ESX
    how to add IIS SMTP to handle application/Scanner relays into office 365.
    In this sixth video of the Xpdf series, we discuss and demonstrate the PDFtoPNG utility, which converts a multi-page PDF file to separate color, grayscale, or monochrome PNG files, creating one PNG file for each page in the PDF. It does this via a c…

    913 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    19 Experts available now in Live!

    Get 1:1 Help Now