how can i limit permissions to the 2nd admin on xp ?

[kejo]

hello

i want to limit my brother's account on xp.

we have 2 admin account and i want his one not to have access to control panel and other things (some program folders)

is there any way to do so (and similar things)?

please help

ps: at least i need that my brother cant change or delete my account password by the control panel..

Edited January 15, 2008 by kejo

[gosh]

group policy

-gosh

[kejo]

any further information?

i found the way to hide control panel, but it's hidden to my account too!

i want to hide it to the other admin only

thanks

Edited January 15, 2008 by kejo

[Idontwantspam]

Can you let us know what version of XP you are using?

You should start off by making his account be non-administrative. Then, check out the link in my sig for group policies via the registry, and see if that'll work for you.

Welcome to MSFN by the way!

[ceez]

you should create a 2nd account which is not an administrative account.

then modify the group policies on the pc, go to start-run type gpedit.msc

from there you can go to user configuration - administrative templates and lock down stuff there.

I usually dont mess with these group policies on a non domain xp workstation so i dont know if what you configure will affect his account. make a change to something simple and see if it messes up your account.

else google something along the line of "group polcies windows xp"

[kejo]

i have got xp pro sp2

now i just set him as a power user

[XP_2600]

Well without a domain environment it gonna be annoying, cause you will need to disable gp each time you login and re enable it before you log off, i recommend make him a user or power user instead of give him administrators permissions.

[cluberti]

I have to agree with everyone here - you're going about this the wrong way. Instead of making someone an admin and locking down privileges, make the user a normal user and GRANT privileges you want him to have. If you give someone admin rights, then you are making that person an admin and locking down accounts like this can be frought with issues.

You're better off creating a regular, low-rights user and assigning permissions to the user in gpedit.msc as necessary.

[Idontwantspam]

To all you advising using gpedit: while it's a powerful tool, it unfortunately is a pain in the butt to use in a non-AD environment. Since changes made in gpedit affect all users of that computer, then anything you do to restrict them will restrict you all. You can still do it through the registry, but using gpedit doesn't always work for situations like these.

Fortunately, Vista has the ability to apply policies to individual users even in a non-AD environment. However, I personally don't think that outweighs the downsides of moving to vista.

[pip22]

Again -- I agree you should create a non-admin account for him to use, 'cos limiting an account which has admin priveleges is a contradiction in itself don't you think?

[kejo]

i just set him as a power user

is this ok now ?

[cluberti]

i just set him as a power user

is this ok now ?

It should be, although power users are "almost admins", lacking only a few admin rights. If you're OK with it though, so are we .

[kejo]

i'd like to know what are the exact differences between Poower users and admins

[Arie]

i'd like to know what are the exact differences between Poower users and admins

I'd like to know why you don't look for answers yourself, but instead ask your question straight away here

Members of the Administrator group have total control over the computer and everything on it. The user named Administrator is the default account within this group.

Administrators can:

• Create, modify, and access local user accounts
  
• Install new hardware and software
  
• Upgrade the operating system
  
• Back up the system and files
  
• Claim ownership of files that have become damaged
  
• Do anything a Power User can
  

The Power User class can perform any task except for those reserved for Administrators. They are allowed to carry out functions that will not directly affect the operating system or risk security.

Power Users can:

• Create local user accounts
  
• Modify user accounts which they have created
  
• Change user permissions on users, power users, and guests
  
• Install and run applications that do not affect the operating system
  
• Customize settings and resources on the Control Panel, such as Printers, Date/Time, and Power Options
  
• Do anything a User can
  

Power Users cannot:

• Access other users' data without permission
  
• Delete or modify user accounts they did not create
  

[kejo]

Power Users cannot:

• Access other users' data without permission
  
• Delete or modify user accounts they did not create
  

that is what i was looking for.