up vote 1 down vote favorite
share [g+] share [fb]

I own the admin account of my PC running, Windows XP Pro edition. There is another Non-admin account in this system. I want to limit the administrative capabilities of this account. That is, to prevent that user from accessing registry, group policy, user accounts panel etc.

Is there anyway to do this without using third party softwares?

link|improve this question
This sounds like a job for superuser.com – mbrownnyc Sep 18 '11 at 16:44
feedback

closed as off topic by GregD, Shane Madden, Ward, jscott, WesleyDavid Sep 19 '11 at 4:00

Questions on Server Fault are expected to generally relate to servers, networking, or desktop infrastructure, within the scope defined in the faq.

2 Answers

up vote 0 down vote accepted

You can create a new security group and assign the user to the group. The group can then be locked down through the policy editor to limit its functionality to your needs.

link|improve this answer
But isn't there a group already for that, called "users", which non admin accounts should already belong to? – DJ Pon3 Sep 18 '11 at 18:35
That's if they do not want to mess with the default groups, if they decide to lock things down even tighter or vary from it in any other ways. – user48838 Sep 18 '11 at 18:44
@user48838 Can you tell me how to create such new security groups? I checked, but couldnt find any such option! – somestranger Sep 19 '11 at 6:25
Head over to "Computer Management" and then under "Local Users and Groups" select "Groups" where you can "right-click" and create "New Group..." – user48838 Sep 19 '11 at 6:32
feedback
up vote 2 down vote

If the other user is no member of the administrators group he wont have administrative capabilities.

As example he will access te user account panel and change his own account but no anothers ones. He can access to the registriy but he cannot change any system configuration. Only its user settings.

So you should worry about it and its capabilities, he wont can change the system settings. If you as example block regedit.exe he can make the exactly same changes using another tools.

If you still want to do it can change the assigments rights of that users using the local policy editor (gpedit.msc) and the ACLs of the executable you want to change.

If you see that the user is capable for change System Settings check its group membership.

link|improve this answer
I have to agree with this. If this "non admin" account can access the registry and control panel (outside of their own settings, at least) then either they're not as "non admin" as the OP thinks or the security of the machine has been compromised somehow, and in either of those cases no advice we can give here will be valid. – DJ Pon3 Sep 18 '11 at 18:34
feedback

Not the answer you're looking for? Browse other questions tagged or ask your own question.