Only 1 administrator on the system

[ponghy]

Hi. I have a little problem on my unattended CD:

When the installation finishes, then the Administrator user is logged on and a user profile is created for this user (this is I want, I don't want any users at the beginning). Ok. But, if I try to create a RESTRICTED user I cannot do this (from User accounts, in control panel). I need to create 1 more administrator in order to create a restricted user and this is not the desired. How can I modify this behavior? That is, I want to have the Administrator user as the ONLY administrator on the system, but I want Windows allows me to add the restricted accounts (without the extra administrator account).

Is this possible? Any registry tweak or administrative template?

Thanks very much for your help

Edited October 17, 2005 by ponghy

[Br4tt3]

Lo.. I am not sure I understand u correctly but I will give it a go!

Adding another administrator can be done with scripting to WSH (vbscripting) easily. Then u can just add the admin with an alternative name an make him a part of the sec group Administrators. Restricted groups membership, can be done by creating a template with the MMC Security Tempates snap-in and exporting it to a .inf file. Once u have done this, u can run secedit to apply this .inf file at installation time.

Hope I got u right..

Keep truckin!

[ponghy]

Not exactly. I will explain more clear:

In unattended mode I have the following line in WINNT.SIF:

[Unattended]
UnattendSwitch = Yes

This makes me log on to the system as Administrator user (the 'real' Administrator). This is I want. But if I don't add any user with administration privileges, Windows don't let me add restricted users. Do you understand?

I know the Administrator user is special for Windows, but I want to use it as the only administrator on the system. And then, this Administrator will make the remaining restricted accounts... How to achieve this??

TIA

Edited October 18, 2005 by ponghy

[ColdFusion200]

net user %Username% %Password% /add
net localgroup Users %Username% /add
net accounts /maxpwage:unlimited

would that work?

[ponghy]

Coldfusion200: Thanks for replying... but no

I want to add restricted users MANUALLY, not in unattended mode. That is, I log on to the system as Administrator, and then MANUALLY I should be able to add restricted users... But as I said above, Windows don't let me add any restricted account without having an extra account with administration privileges ("other administrator").

[ColdFusion200]

Coldfusion200: Thanks for replying... but no

I want to add restricted users MANUALLY, not in unattended mode. That is, I log on to the system as Administrator, and then MANUALLY I should be able to add restricted users... But as I said above, Windows don't let me add any restricted account without having an extra account with administration privileges ("other administrator").

it isnt just for unattended. it will work when windows is running too. try it, see if it solves you're problem

[ponghy]

Sorry for too many posts

But, I don't want to add programatically restricted users. Any person using the Administrator account should be able to add a restricted user via Control Panel > User Accounts.

Now, I hope you understand my problem...

[ColdFusion200]

Sorry for too many posts

But, I don't want to add programatically restricted users. Any person using the Administrator account should be able to add a restricted user via Control Panel > User Accounts.

Now, I hope you understand my problem...

i understood it in the first place, but i dont know how to sort it, if it can be fixed without creating another admin account that is. i was providing you with a workaround

[Takeshi]

Try this:

lusrmgr.msc > Users > Action > New Users

[gunsmokingman]

I believe but do not quote me is that you need another admin account before creating

just a user account. You could try this make another admin account, then create the

user accounts, then delete the new admin account.

[Takeshi]

I've just done an expt. in VMWare with my existing uA install. I remove the other admin acc leaving only the Admin acc. Then the Local Users and Groups would let me directly create a new account which turns out to be a Limited account.

The XP User Account applet still would not let me do it. I think this is by design. This limitation is not due to uA per se.

The Local Users and Groups, which can also be accessed from the classic User Account applet (for domain and W2k) and the net user command seem to be the only way.

Edited October 19, 2005 by Takeshi

[MHz]

Net User to create the user

Net LocalGroup to assign where the user should be...

Net Group is for a domain...

Try it

HTH

[Eki]

@ponghy

W2K Style user accounts snap-in lets you create restricted accounts without creating admin user first.

Type "control userpasswords2" in runbox or create shortcut to

%windir%\system32\control.exe userpasswords2

Eki

Edited October 20, 2005 by Eki

[ponghy]

Thanks very much for your replies. I will try some ideas

I appreciate your feedback

[ponghy]

If I use the OOBEINFO.INI Method (as explained in the guide), and I'm using UnattendSwitch = Yes, Will this work?

Thanks.

Edited October 24, 2005 by ponghy