Administrator account and nLite

[Lorinette]

Hello,

I continue my questions about nLite. This time, I have some questions about the configuration process step where I can choose to enter the activation KEY, skip oobe or setup users.

As you know, by default, nLite is configured with two accounts: Administrator and Guest.

The Administrator account is the super admin, the owner of the PC. It would be hidden on the logon screen and could be displayed and loged in by hitting the CTRL+ALT+DEL keys twice.

So here come some questions about this things and about nLite:

QUESTION 1: Do you think I can rename the Administrator name to set what I want like: Sysadmin? Or maybe it's better to let it as it is in the nLite menu?

QUESTION 2: Is it normal that when I add two limited accounts and rename the Administrator in the full automatic mode installation process to Sysadmin, I can see the Sysadmin on the logon screen renamed? Shouldn't it be hidden as it's the super admin of the PC? AND, is it normal, that, in the same situation that when I upgrade one of the two limited accounts to an admin account, the Sysadmin (owner) account becomes hidden on the logon screen after a reboot? And than in order to show it again, I have to downgrade the admin to limited user account through the "gpedit.msc" options?

QUESTION 3: And then, why is the Administrator hidden when I choose to do the installation step by step with all the confirmations and accounts to set by hand? And why not, when the installation is full automated?

QUESTION 4: In the manual step by step mode installation, when I'm in the oobe process, the system asks me to enter at least one user of this computer. The first one will be an administrator, but not the super administrator which is hidden. Is this normal?

QUESTION 4: Globally, what is the good way to setup accounts for three persons on the same PC in full automatic mode? Should I create 3 limited accounts by letting the hidden Administrator as it is? Or, create two limited and one normal admin account?

By the way, do you have any documentation for these questions?

Thanks and sorry for my english.

[johnhc]

Lorinette, I will try to give you my opinion on your questions. I don't know the answers and possibly you can share your experience with us. I suggest your try several combinations and I hope you are testing under a virtual system (VirtualPC, VirtualBox, VMware Server - all free). Please attach (not paste) your Last Session.ini so we can see what you are doing.

Some notes: Your English is fine and all but nuhi are users here as yourself.

1. I opened nLite and went to the Unattended-Users tab and tried to delete the Guest and the Administrator accounts - not possible. I was able to rename both accounts. What effect this will have on the Logon screen, I do not know. Please let us know.
   
2. Don't know. I suspect whatever you name it the Administrator account will remain the same attributes. Any new account you create with administrator privileges will have the same authority as Administrator and will show up on the Logon screen. I create only one account for me, and give it administrator privileges.
   
3. I guess this is the way MS decided to do it.
   
4. I am sure nLite has not changed this. I suspect this is so you will have at least one account on the Logon screen, since Administrator is hidden and Guest is inactive by default.
   
5. Your second 4. This is of course your choice knowing the people and what kind of privileges you want to give them. If it were me, I would leave the Administrator account alone, give myself administrator rights and the others limited accounts unless I felt they were experienced enough to install programs, etc.
   

I don't have any documentation but there is a guide and FAQs on the nLite web site and these forums are a great source of information. Hope this helps, John.

[iamtheky]

Default administrator is only hidden when you create another account with administrator privileges. This is a product of XP not Nlite. Since you are already in the gp why not just alias the default administrator to sysadmin then you can be the "super admin". You could then create the other two users in the .cmd via NET USER commands.

I would guess the driving factor is that if you have to explicitly specify admin rights you are less likely to inadvertently hose your system.

[Ponch]

All your discoveries come from the fact the "normal" way of installing XP is OOBE.

This is what Microsoft think you should have:

1) an Administrator account you don't mess with (because they know... profiles sometimes get corrupted and then you're in trouble)

2) a user with admin rights which is the one you create at OOBE and is the one the "user" works with

-other accounts if wanted, (and Guest) created or not at OOBE or later (or sooner).

When you use nLite and/or unattended, you skip OOBE or you don't get in the shema above (in your case clearly ONE Administrator, two non admin), things become not unpredictable but maybe surprising.

+Yes, you can rename "the" Administrator.

[XP_NO]

Hmmm, this is strange.

I have tried to rename 'the' administrator but ended with setting the administrator and guest to non-active and adding a new user with administrator rights. I will check this later on again, but I am almost 200% sure it was not possible to change the name of the admin

[Lorinette]

Hello,

Thanks for your replies, you've written very interresting things!

@John: I'm doing my tests on a real PC, an old PIII 500 mhz. In fact, iamtheky and Ponch gave the responses to my questions, so I guess I don't have to do the tests.

@iamtheky and Ponch: Thank you very much for the answers! It's very clear and logical the way you explain it. I've learned something tonight and I'm going to wake up much aware about the WinXP functionment!

By the way, maybe one of you guys now what's the ASP.NET account in the Group Panel? I can guess it have something to deal with the 3.5 SP1 NET Framework I've installed, but do you know how it exactly works? Does it send any information on the network? Could I delete it?

An other question that is quite obscure for me is about the Users that are in the USERS group. I don't know what's the name for it in english installations, but in french, the menu I'm talking about calls "Gestion de l'ordinateur > Utilisateurs et groupes locaux". There's my question: Do you know who are the "AUTORITE NT\INTERACTIF (S-1-5-4)" and the "AUTORITE NT\Utilisateurs authentifiés (S-1-5-11)" ? How this two users create? What are they for? Can I delete them? Any documentation about this?

Again, thanks for everything. I love to learn things that allows me to better manage my PC under WinXP.

[johnhc]

Gestion de l'ordinateur > Utilisateurs et groupes locaux

Babelfish translates this to "Management of l' computer > Local users and groups"and

AUTORITE NT\Utilisateurs authentifiés

to "AUTHORITY NT \ authenticated Users "

Enjoy, John.

[iamtheky]

I dont know what percentage wrong you can be if you are 200% sure but....

adding these lines to the security template you apply will work:

[system Access]

NewAdministratorName = "new.admin.name"

NewGuestName = "new.guest.name"

[Lorinette]

By the way, maybe one of you guys now what's the ASP.NET account in the Group Panel? I can guess it have something to deal with the 3.5 SP1 NET Framework I've installed, but do you know how it exactly works? Does it send any information on the network? Could I delete it?

An other question: Do you know who are the "AUTORITE NT\INTERACTIF (S-1-5-4)" and the "AUTORITE NT\Utilisateurs authentifiés (S-1-5-11)" ? How this two users create? What are they for? Can I delete them? Any documentation about this?

[JatinBeniwal]

Dot net framework is vb dot framework library for many programs to work. Many programs run in dotnet environment. but to keep program small dotnet libraries not included in program. Installing dotnet framework required to run that program efficeintly. For ex. vlite,nlite etc. need dotnet 2.0 to work.

[Lorinette]

Thanks JatinBaniwal but that's not my question. So If someone really knows what I'm talking about please give your answer.

[JatinBeniwal]

By the way, maybe one of you guys now what's the ASP.NET account in the Group Panel? I can guess it have something to deal with the 3.5 SP1 NET Framework I've installed, but do you know how it exactly works? Does it send any information on the network? Could I delete it?

it does not send any information on the network. so it is better to keep it? Also i don,t get ASP.net icon in my vista installation. I m using vista sp2. I don,t know answer abt ur 2nd question. Can u tell me which version of xp u uses & in which language?

[iamtheky]

For a full explanation of your machine accounts:

http://technet.microsoft.com/en-us/library/cc780850.aspx

"as for the asp.net user, this is the M$ explanation"

If one works with asp.net development work then he/she must keep that account,otherwise ASP.net projects will no longer function correctly.

Edited January 3, 2009 by iamtheky

[Lorinette]

Excellent!

Thank you very much for the link iamteky. It seems very usefull with lot of information.

I have no more questions about this topic, and by the way as it was mentioned: Yes, it's possible the rename "the" Administrator account without any problems. I've tested it and didn't encountered any problems.

[XP_NO]

@Iamtheky;

Okay, seems it is because I am using XP HOME editition that I can not change the adminstrator name and login like that. I have to add a new user with administrator rights (is nlite saying with a popup, so I guess this is right).

But now I know why it is, so for me the problem is solved.

Thanks for mentioning your solution;

• I have learned now that I also have to save the second ini file (the *_u.ini), where I thought it was a temporary ini file,
  
• I now know why it is not working for me with only the administrator account
  

Never too old to learn

Edited January 4, 2009 by XP_NO