Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I own the admin account of my PC running, Windows XP Pro edition. There is another Non-admin account in this system. I want to limit the administrative capabilities of this account. That is, to prevent that user from accessing registry, group policy, user accounts panel etc.

Is there anyway to do this without using third party softwares?

share|improve this question

closed as off topic by GregD, Shane Madden, Ward, jscott, Wesley Sep 19 '11 at 4:00

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

This sounds like a job for – mbrownnyc Sep 18 '11 at 16:44
up vote 0 down vote accepted

You can create a new security group and assign the user to the group. The group can then be locked down through the policy editor to limit its functionality to your needs.

share|improve this answer
But isn't there a group already for that, called "users", which non admin accounts should already belong to? – RobM Sep 18 '11 at 18:35
That's if they do not want to mess with the default groups, if they decide to lock things down even tighter or vary from it in any other ways. – user48838 Sep 18 '11 at 18:44
@user48838 Can you tell me how to create such new security groups? I checked, but couldnt find any such option! – somestranger Sep 19 '11 at 6:25
Head over to "Computer Management" and then under "Local Users and Groups" select "Groups" where you can "right-click" and create "New Group..." – user48838 Sep 19 '11 at 6:32

If the other user is no member of the administrators group he wont have administrative capabilities.

As example he will access te user account panel and change his own account but no anothers ones. He can access to the registriy but he cannot change any system configuration. Only its user settings.

So you should worry about it and its capabilities, he wont can change the system settings. If you as example block regedit.exe he can make the exactly same changes using another tools.

If you still want to do it can change the assigments rights of that users using the local policy editor (gpedit.msc) and the ACLs of the executable you want to change.

If you see that the user is capable for change System Settings check its group membership.

share|improve this answer
I have to agree with this. If this "non admin" account can access the registry and control panel (outside of their own settings, at least) then either they're not as "non admin" as the OP thinks or the security of the machine has been compromised somehow, and in either of those cases no advice we can give here will be valid. – RobM Sep 18 '11 at 18:34

Not the answer you're looking for? Browse other questions tagged or ask your own question.