Member Avatar for carinilumpyhead

My friend has two HP desktop computers running Windows XP (SP3) in his living room and entertains many, many guests daily. Guests who do not usually carry laptop/netbook with them are allowed access to these computers and their internet connections without much supervision. Most of said users are very respectful of their privileges and limit their usage mostly to checking emails, updating Facebook/MySpace/Twitter, etc., or playing games (either already installed or online) without downloading more apps and toolbars or worse. I have for months been acting as an ad hoc administrator, handling antivirus/malware scanning, updates, fixing crashes. I am by no stretch of the imagination an IT guy, but have managed to maintain my own computers for years with relative ease and few catastrophic problems.
I now enjoy a fancy HP laptop with windows 7 64 bit and paid maintenance subscriptions (antivirus/spyware/warranty) on which I rarely have guests accessing it. On those few occasions when someone else uses my laptop, win 7 provides easy to use user account controls for which I may easily setup multiple accounts with varied levels of permissions. XP, however, at least as far as I have been able to determine, provides no such degree of utility or ease over multiple logins.
My idea is to assign usernames to frequent guests with passwords and some sort of limited permissions to access or modify settings/apps/networking. Does anyone know of utilities to achieve this other than the default admin/guest accounts? Even at this level, guests may access most areas that admins can, with very few critical exceptions. Perhaps there is some 3rd party app that offers some sort of virtualized access control?
Aside from this, I would also like to limit access time with either auto logoffs or auto shutdowns from which only the admin account can recover. Can someone please point me in the right direction?

  • 2 Contributors
  • 1 Reply
  • 199 Views
  • 6 Hours Discussion Span
  • Latest Post Latest Post by jak0b

Dani AI

Generated

Good direction — create separate limited accounts for frequent guests and remove Administrator rights from those accounts. Check whether the machines are XP Home or XP Professional first: XP Pro exposes the Local Users & Groups MMC (more granular control), while XP Home is limited to the simple User Accounts UI (so some advanced tweaks below only apply to Pro). Mention of portable/portable-app risk by is important: limited accounts reduce casual changes but do not stop all USB/portable tricks. (vdoc.pub)

Logon-time enforcement (works on both Home and Pro): use the built-in net user /times option to define hourly login windows. Example (run from an elevated command prompt as Administrator):

net user Guest01 /times:M-F,9AM-10PM
net user Guest01 /times:all       <- removes limits

Notes: times are in whole-hour increments and the setting prevents new logons outside the window but does not forcibly log off a user already signed in. Verify with net user Guest01 after applying. (learn.microsoft.com)

To enforce a hard cutoff for already-logged-in guests, schedule a nightly restart or logoff (Task Scheduler / schtasks) that runs a shutdown/logoff command at the chosen time. Example to schedule a daily restart at 01:00:

schtasks /create /tn "NightlyRestart" /tr "shutdown /r /t 0" /sc daily /st 01:00

This forces sessions to end so time restrictions take effect on next logon. Use the GUI Task Scheduler if preferred. (learn.microsoft.com)

For better app control, use Software Restriction Policies (SRP) on XP Professional (Local Group Policy → Security Settings → Software Restriction Policies) to whitelist permitted programs or block execution from user-temp and removable-media locations; SRP can stop many portable-app workarounds. For a shared/public setup, consider a “reboot-to-restore” product (Deep Freeze / Reboot Restore Rx) or the older Microsoft SteadyState concept (now discontinued) to return machines to a known state — SteadyState itself is no longer supported. Finally, remember Windows XP is out of Microsoft support (no security updates), so isolating these PCs from sensitive accounts or upgrading is strongly advised. (learn.microsoft.com)

Member Avatar for jak0b

You have extensive user account controls in XP, almost like in Win7, but defaults might have been changed if guest account can access as much as you claim.

Go to control panel to create new accounts, and just create the users that you need/want.
let them have ordinary user access (no admin rights), and the defaults should prevent them from installing almost all programs (some browsers are exceptions).

All portable apps can usually run on the guest account unless you disable it, and there are some very power-full portable apps that can mess with the registry, and the defaults - so I can't promise that it will be enough to solve your problems.


If you type "control userpasswords2" in the "run" in start menu - you get to the user account control panel - use right click for options to create new users etc.

Keep an eye out for the "advanced" buttons and tab's to see the options, and also try to right click on anything for various menu's. ;)

Edited by jak0b because: n/a
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.