Member Avatar for gandiya

Is it possible to create AN EXCLUSIVE USER ACCOUNT IN WINDOWS 2000 PRO? What I mean is:None of the other users,including the Administrator,should be able to see and access my installed applications and of course my data.How do you install applications only for the current user,when the program installer doesn't give you that choice? :D :D :D

  • 5 Contributors
  • 8 Replies
  • 134 Views
  • 3 Days Discussion Span
  • Latest Post Latest Post by Catweazle

Dani AI

Generated

Short answer up front: you cannot make data or installed programs truly invisible to a machine Administrator. That is the fundamental Windows security model: Administrators can change ACLs, take ownership, and access any files. That point from is correct, but there are practical ways to meet your goals (keep others from using or casually seeing your apps) without trying to defeat administrative control.

Practical options and tradeoffs:

  • Per-user installs and portable apps: the only reliable way to keep applications confined to one account is to install them into that user�s profile (Documents and Settings\<you>\Local Settings\Application Data or your Start Menu) or use portable builds. Many installers require admin rights and will put files in Program Files and keys in HKLM; those installs will be accessible to other accounts even if you hide shortcuts.
  • NTFS permissions: set the program folder and your data folder ACLs so only your account can read them. This stops ordinary users, but an Administrator can always change permissions or take ownership, so it�s not foolproof.
  • Encryption for sensitive data: use EFS (Encrypting File System) or a trusted third-party container to protect files so only your account can decrypt them. Export and backup your EFS keys/certificates. Note: if an admin resets your account password incorrectly, EFS-protected files can become unrecoverable without the key backup.

How to reduce disruption when removing admin rights (answering and ):

  • Don�t simply demote an existing admin you want to keep using. Create a new non-admin (Power User/User) account for them, then copy the original profile to the new account via System Properties -> Advanced -> User Profiles -> Settings -> Copy To, and set the permitted user. Test the new account before deleting or demoting the original.
  • For applications tied to the old account by SID or HKLM registry entries, you may need to reinstall or reconfigure them for the new account.

Final cautions: before changing group membership or ACLs, make a full backup (including exported EFS keys if used). If the goal is secrecy from other people who have administrative rights, the only real protections are strong encryption and careful off-machine or removable-media storage.

Recommended Answers

All 8 Replies

Member Avatar for Catweazle

No, you can't create an account which is inaccessible to the Administrator account.

Member Avatar for I_Broke_My_Mhz

..but you can create one administrator account and have all the other users just power users or lower.

Member Avatar for gandiya

WHAT IF I CREATE FOLDERS LIKE PROGRAMFILES_USER NAME[ADMINISTRATORS GROUP],START_USERNAME ETC. WOULD MY PURPOSE OF CREATING AN EXCLUSIVE ACCONT BE SERVED?YOU SEE BY AN OVERSIGHT I CREATED AN ADMINISTRATOR ACCOUNT FOR THE OTHER USERS OF THE COMPUTER THAT I OWN AND CREATED AN OTHER ACCOUNT IN MY OWN NAME[MEMBER OF THE ADMINISTRATIVE GROUP].I DON'T WANT THOSE GUYS TO SEE OR ACCESS ANY OF MY APPLICATIONS.BY THE WAY IS THERE ANY WAY BY WHICH I CAN TRANSFER THAT ACCOUNT TO THE POWER USERS GROUP WITHOUT AFFECTING THEIR SETTINGS TOO MUCH? :?: :?: :?:

Member Avatar for alc6379

WHAT IF I CREATE FOLDERS LIKE PROGRAMFILES_USER NAME[ADMINISTRATORS GROUP],START_USERNAME ETC. WOULD MY PURPOSE OF CREATING AN EXCLUSIVE ACCONT BE SERVED?YOU SEE BY AN OVERSIGHT I CREATED AN ADMINISTRATOR ACCOUNT FOR THE OTHER USERS OF THE COMPUTER THAT I OWN AND CREATED AN OTHER ACCOUNT IN MY OWN NAME[MEMBER OF THE ADMINISTRATIVE GROUP].I DON'T WANT THOSE GUYS TO SEE OR ACCESS ANY OF MY APPLICATIONS.BY THE WAY IS THERE ANY WAY BY WHICH I CAN TRANSFER THAT ACCOUNT TO THE POWER USERS GROUP WITHOUT AFFECTING THEIR SETTINGS TOO MUCH? :?: :?: :?:

HOLY SMOKES!

That has to be the ugliest combination of fonts and all caps that I have ever seen. I got confused just reading that. Can you please repost the question, and then change the font and/or all caps in the post?

Member Avatar for JAMMAN

WHAT IF I CREATE FOLDERS LIKE PROGRAMFILES_USER NAME[ADMINISTRATORS GROUP],START_USERNAME ETC. WOULD MY PURPOSE OF CREATING AN EXCLUSIVE ACCONT BE SERVED?YOU SEE BY AN OVERSIGHT I CREATED AN ADMINISTRATOR ACCOUNT FOR THE OTHER USERS OF THE COMPUTER THAT I OWN AND CREATED AN OTHER ACCOUNT IN MY OWN NAME[MEMBER OF THE ADMINISTRATIVE GROUP].I DON'T WANT THOSE GUYS TO SEE OR ACCESS ANY OF MY APPLICATIONS.BY THE WAY IS THERE ANY WAY BY WHICH I CAN TRANSFER THAT ACCOUNT TO THE POWER USERS GROUP WITHOUT AFFECTING THEIR SETTINGS TOO MUCH?

Log in as administrator and take the admin rights away from them. Then they can't see your "stuff" start/settings/control panel/users and passwords

Member Avatar for Catweazle

HOLY SMOKES!

That has to be the ugliest combination of fonts and all caps that I have ever seen. I got confused just reading that.

It hurt my eyeballs!!!!!

I am SOOOOO gonna ask Dani if we can introduce mandatory penalties for people who post stuff which looks like that.

Burning at the stake wouldn't be too severe, do you think?

Member Avatar for gandiya

sorry!!!!!!!! pals.It won't happen again! Ah! I forgot!, techies are supposed to be serious guys,but why should they be so colorless and dictatorial? LOL!LOL!LOL! Just joking,please don't ban me! Does this mean,colors and odd font sizes are banned?

Member Avatar for Catweazle

:lol::lol::lol:

Nah!!

We're just saying that the font, colour and caps that you used looked BLOODY AWFUL!!!!!!!!!!!

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.