user permission

[hrbaban]

hi . . .

I want create a user (no admin ) that can only create another new users .

which permission do i set to do that ?

[Idontwantspam]

You mean you don't want it to be able to do anything else, even log on? What is the purpose of this account? I'm not sure if it's possible to only let it make new users and nothing else... maybe through the user rights assignment part of local security policies (secpol.msc)?

[hrbaban]

Hi . . . Idontwantspam . . .

I mean this user can do general thing and general permission similar usual user or nomal user but i want that he can also create new users .

My perpose of this account is except of administrator this user can also create new users .

thanks .

[Idontwantspam]

Well, any user can create new users that have the same account level or lower than the account creating it. In other words, a user account that is a member of the administrators group can make an account that is a member of any group including but not limited to the administrators group. A Power User can create Power Users, regular Users and Guests, but cannot create Administrator accounts. Likewise, Users can create Users and Guests, but not Power Users or Administrators. There is no way for a user account to create an account with a higher status than itself, or else the user of said account could escalate themselves to higher levels, which of course would be a vulnerability. So, yes a normal account can create other normal accounts, if that is what you want to do. One note; the default windows xp user accounts control panel won't let non-admins create new user accounts, however, it can be done through lusrmgr.msc (Local Users and Groups snapin) or using the net user command.

Hope that helps.

[hrbaban]

Thanks . . .Idontwantspam . . .

Now , can i create normal user who can install hardware ?

Edited May 5, 2008 by hrbaban