allowing limited users to install software

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

Well I guess, if you give them an access through the account which is
the member of Administrators group, they will be able to do anything
they want on the machine. They can take ownership of the files from
your other account and view them ...

You can do two things:
1. Create two admin accounts with different passwords. Log on with
first admin account and then encrypt all your files. Give the IT stuff
password for the other admin account. That way they can not access the
encrypted files but they will be able to install software.

or

2. Give them access to account which is member of Power Users group.
That way they can install software on the computer but they do not have
enough power to poke around your admin files.
Hope this will help.
branac

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

Power Users can do these things:
1. Create local user accounts (they can create user accounts in
Power Users and Users groups but not in Administrators group)
2. Modify user accounts which they have created
3. Change user permissions on users, power users, and guests
4. Install and run applications that do not affect the operating
system
5. Customize settings and resources on the Control Panel, such as
Printers, Date/Time, and Power Options

Power Users cannot:
1. Access other users' data without permission (they can not take
ownership of a file unless that permission is specificaly granted to
them, Administrators can take ownership of any file on the computer
anytime they like)
2. Delete or modify user accounts they did not create

So if you have files under an Administrator account, Power User can not
touch them and can not find any way around.

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

Hi

Sorry to jump in but what are the "rights" of the various User Groups? I
was aware of the Power Users Group and assumed that this was a very high
level group. From your comment, it isn't as high as I would have thought.

"branac" <branislav.karic@gmail.com> wrote in message
news:1106338896.686200.318700@f14g2000cwb.googlegroups.com...
> Well I guess, if you give them an access through the account which is
> the member of Administrators group, they will be able to do anything
> they want on the machine. They can take ownership of the files from
> your other account and view them ...
>
> You can do two things:
> 1. Create two admin accounts with different passwords. Log on with
> first admin account and then encrypt all your files. Give the IT stuff
> password for the other admin account. That way they can not access the
> encrypted files but they will be able to install software.
>
> or
>
> 2. Give them access to account which is member of Power Users group.
> That way they can install software on the computer but they do not have
> enough power to poke around your admin files.
> Hope this will help.
> branac
>

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

"Paul" <Paul@discussions.microsoft.com> wrote in message
news:ED09125B-94DA-459F-9137-2A8CD9BB2E7E@microsoft.com...
>I want to have some software installed on my pc by the IT staff at work,
>but
> don;t want them to have access to my files. I am running XP Pro and have
> two
> administrator profiles that share files. My thought is to create a guest
> profile for them to install the software without giving them access to my
> files.
>
> Can limited profiles install? or is there a way to share files between
> only
> certain profiles? I know how to make folders private, but want to share
> them
> with the other admin acct.
>
> The only way I can think to do this otherwise is to temporarily move all
> folders from the other admin acct to my profile and then password restrict
> my
> account log in and let IT use the other stripped down admin account.
>
> Any ideas? Thanks ahead.

If you are really that concerned, you should either be there with them or
remove the files temporarily to a CD that you store in a locked location.
Anyone who has physical access to your system could get any unencrypted
information regardless of what level of account you give them (or even no
account at all.) Some people might call these techniques 'hacking' or
'cracking' but it is pretty easy to do.

If you are only concerned about them casually browsing your files as opposed
to actually spending time to break in, the Power Users group might help.
Unfortunately some apps are written in such as a way that the setup program
refuses to run unless the user is an Administrator. (I've even seen some
horrible ones where the app insists that you log on as the built-in
Administrator account.)


--
Colin Nash
Microsoft MVP
Windows Shell/User

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

Thank you for the explanation.