Limiting user access in XP

Discussion in 'OT Technology' started by JennBabe, Jul 21, 2004.

  1. JennBabe

    JennBabe New Member

    Joined:
    Jan 16, 2002
    Messages:
    202
    Likes Received:
    0
    I'm installing XP professional on my coworker's computer. She has a 16 year old son who likes to download files (along with two other kids), and they've had tons of viruses and have had to reinstall 98se dozens of times. Now that they will finally let me install XP, I need to know what kinds of limits I can put on user accounts, so that her son can't download and install anything, but can still do stuff online.

    Any help would be appreciated!
     
  2. Penguin Man

    Penguin Man Protect Your Digital Liberties

    Joined:
    Apr 27, 2002
    Messages:
    21,696
    Likes Received:
    0
    Location:
    Edmonton, AB
    If you don't give him an administrator account, he won't be able to install anything I believe.
     
  3. logan1

    logan1 Guest

    i dont think thats true....but i could be wrong......
     
  4. Apothis

    Apothis New Member

    Joined:
    Sep 14, 2003
    Messages:
    2,240
    Likes Received:
    0
    Location:
    San Antonio, TX
    First off, you'll obviously want to be on NTFS rather than FAT. Also, I hope we're talking about XP PRO here, because Home edition has pretty much no security outside of initial login. It's like a smacked up ME. Pro edition is more along the lines of NT/2K though.

    After install, probably the first thing you want to do is go into folder options > view > uncheck "simple file sharing". This drastically increases your security options for files/folders. Also, go into either Control Panel > User Accounts OR right-click "my computer" and select Manage > Local Users and Groups. Make sure the kids have their own accounts and that they are ONLY a member of the "Users" group (not Administrators). If you do this through Control Panel, you will have the option of either Administrator or "Limited User". If you go though Manage computer, you have more options such as Power Users, ect. In any case, they kids should be just basic users. They will be unable to install most programs (but not all). The will also not have write access to much of anything outside of their own documents and they won't have access to make system-level changes.

    Something to keep in mind though: For the most part, XP has decent security (NT systems are about the best Windows you'll get). However, there are many instances where it will be terribly inconvenient because Windows has its head up its ass a lot of the time. On the surface it seems to have good multi-user support, but often it just blows compared to the *nix. You see, MS designed everything from the ground up under the assumption that the user, any user, would be administrator. Most 3rd party software also operates under this assumption. So many legit programs either work like crap, or don't work at all, due to access issues. These programs didn't take multiple users into account, or otherwise complete screwed it up. This is especially common with GAMES (which the kids would likely be into). Take D2 and NWN for instance. NWN can be played by a regular user, but it gives you an error message every time. And D2? That doesn't work at all, on bnet at least, unless you have admin rights.

    The point is: MANY programs are like that. So in her quest to beef up security, she may also shoot herself in the foot, or make it hardly worth using for the kids. It still won't be totally secure (if there even is such a thing, windows would be very far from it). So you may have increased security on the machine, and it may prevent a good number of problems. But odds are, it would cause just as many new ones, depending on how much the computer gets used and what it's used for.

    You can exercise even more control through the use of policies, but that get's to be significantly more advanced than the above and you can screw things up badly if you don't know what you're doing. Even with everything on minimal security though, XP (either version) is still infinitely better than 98.
     
  5. Homeless

    Homeless New Member

    Joined:
    Jun 20, 2004
    Messages:
    975
    Likes Received:
    0
    Location:
    NY
    Why not just use a virus scanner if they download viruses alot? You can also just change the internet settings in IE.

    [​IMG]
    Or ultimately, you can just remove IE.
     
  6. Apothis

    Apothis New Member

    Joined:
    Sep 14, 2003
    Messages:
    2,240
    Likes Received:
    0
    Location:
    San Antonio, TX
    Well it's impossible to actually "remove" IE, because it's part of the OS itself. But you can stop using it in favor of a much better browser such as Firefox. That by itself will make a tremendous difference in how much junk you pick up. As for keeping a virus scanner installed and running, well ..that should pretty much be a given. A firewall would also be a good idea.
     
  7. Keyzs

    Keyzs OT Supporter

    Joined:
    Nov 3, 2003
    Messages:
    814
    Likes Received:
    0
    Location:
    Charlotte, MI
    Its kinda funny that parents want the computer to babysit their children instead of controlling the kids themselves... If the son cannot keep himself away from things he shouldn't be playing with he shouldn't be using the computer. And the other two need to go home and play with their parents computers - oh wait their parent probably will not let them screw up their machines so they have to find a sucker who will...
     
  8. maczter

    maczter Life is trying things to see if they work.

    Joined:
    Sep 30, 2003
    Messages:
    3,622
    Likes Received:
    0
    Location:
    Austin, TX
    You can't remove it, but you can remove all easy access to it via the Add/Remove Windows Components" pane of the "Add or Remove Programs" Control Panel. Just deselect Internet Explorer once you're there and it will remove the pesky desktop shortcut. You'll probably still need to delete it from the Start Menu. I just did this on my Dad's computer this weekend so he wouldn't forget and accidentally use it again (his machine was badly infested by spyware).
     
  9. mdaniel

    mdaniel S is for Shiksa

    Joined:
    May 6, 2000
    Messages:
    52,515
    Likes Received:
    316
    Location:
    Northwest Mejicooooooo
    Don't forget that you'll still need IE to access windowsupdate.microsoft.com.
     
  10. maczter

    maczter Life is trying things to see if they work.

    Joined:
    Sep 30, 2003
    Messages:
    3,622
    Likes Received:
    0
    Location:
    Austin, TX
    You can still get to it through the Start => Programs menu, it just takes away all the shortcuts so you have to work to get to it.
     
  11. Blade

    Blade Time to swolercize

    Joined:
    Oct 21, 2002
    Messages:
    14,736
    Likes Received:
    0
    Location:
    Murfreesboro, TN Rep: ★
    type gpedit.msc, play with that too, show those fuckers
     
  12. Apothis

    Apothis New Member

    Joined:
    Sep 14, 2003
    Messages:
    2,240
    Likes Received:
    0
    Location:
    San Antonio, TX
    Still though, making IE less likely to be used would still be a step in the right direction.
    ;)
     
  13. maczter

    maczter Life is trying things to see if they work.

    Joined:
    Sep 30, 2003
    Messages:
    3,622
    Likes Received:
    0
    Location:
    Austin, TX
    agreed.
     

Share This Page