Sign in with
Sign up | Sign in
Your question

Can permissions on the Local System account be changed?

Last response: in Windows XP
Share
Anonymous
a b 8 Security
August 15, 2005 8:52:41 AM

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

Can permissions on the Local System account be changed or removed etc.
If so, how?

Or are the permissions fixed and cannot be changed?

Thanks.
August 15, 2005 11:49:22 AM

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

johnwilliams_esquire@hotmail.com wrote:

> Can permissions on the Local System account be changed or removed etc.
> If so, how?
>
> Or are the permissions fixed and cannot be changed?
>
> Thanks.

You haven't given us enough information to get a specific answer. Is
this a standalone machine or on a workstation connected to a domain?
What version of XP and what service pack level? Are you the domain
administrator?

Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User
Anonymous
a b 8 Security
August 15, 2005 9:08:09 PM

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

Malke wrote:
> johnwilliams_esquire@hotmail.com wrote:
>
> > Can permissions on the Local System account be changed or removed etc.
> > If so, how?
> >
> > Or are the permissions fixed and cannot be changed?
> >
> > Thanks.
>
> You haven't given us enough information to get a specific answer. Is
> this a standalone machine or on a workstation connected to a domain?
> What version of XP and what service pack level? Are you the domain
> administrator?

It's for XP Professional SP2. FWIW I'd like to know the answer in the
case of a standalone m/c and a box connected to a domain (and whether
or not I'm the domain administrator). Thanks for distinguishing those
scenarios.
Related resources
August 16, 2005 12:55:13 AM

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

J Williams wrote:

>
> Malke wrote:
>> johnwilliams_esquire@hotmail.com wrote:
>>
>> > Can permissions on the Local System account be changed or removed
>> > etc. If so, how?
>> >
>> > Or are the permissions fixed and cannot be changed?
>> >
>> > Thanks.
>>
>> You haven't given us enough information to get a specific answer. Is
>> this a standalone machine or on a workstation connected to a domain?
>> What version of XP and what service pack level? Are you the domain
>> administrator?
>
> It's for XP Professional SP2. FWIW I'd like to know the answer in the
> case of a standalone m/c and a box connected to a domain (and whether
> or not I'm the domain administrator). Thanks for distinguishing those
> scenarios.

Well, of course you can change permissions. If you have a standalone
machine running XP Pro (as you do), you can set very fine-grained
permissions by using the Group Policy Editor.

Start>Run>gpedit.msc [enter]

You need to be logged in with an account with administrative privileges.
If you want to know more about the Group Policy Editor, then type that
into XP's Help & Support. Be careful working with the Group Policy
Editor; it is completely possible to lock yourself out! There is also a
newsgroup for the Group Policy Editor if you have specific questions
about it:

microsoft.public.windows.group_policy

If you have a workstation joined to a domain, permissions are usually
set at the domain level and although there may be a local administrator
for emergencies, normally regular users would not be able to log in as
local administrator or set/change permissions on the domain
workstation. One of the reasons for running a domain is to have central
control of the workstations.

If you want to know more about domain set up and best practices, this is
a vast subject. I suggest starting with TechNet, which is a marvelous
resource:

http://technet.microsoft.com/default.aspx

Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User
Anonymous
a b 8 Security
August 17, 2005 1:35:00 AM

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

As Malke noted, its is entirely possible to lock yourself out of critical functions with the Group Policy Editor, on a stand alone machine. On a stand alone computer, policies put in place using the Group Policy Editor apply to all users of the machine.

You need to provide more information about what you're trying to accomplish, or what permissions/capabililties you are trying to give/remove from the Local System account.

--
Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display\Security
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
--------------------------------
Per user Group Policy Restrictions for XP Home and XP Pro
http://www.dougknox.com/xp/utils/xp_securityconsole.htm
--------------------------------
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.

"Malke" <invalid@not-real.com> wrote in message news:o ypgPZhoFHA.576@TK2MSFTNGP15.phx.gbl...
>J Williams wrote:
>
>>
>> Malke wrote:
>>> johnwilliams_esquire@hotmail.com wrote:
>>>
>>> > Can permissions on the Local System account be changed or removed
>>> > etc. If so, how?
>>> >
>>> > Or are the permissions fixed and cannot be changed?
>>> >
>>> > Thanks.
>>>
>>> You haven't given us enough information to get a specific answer. Is
>>> this a standalone machine or on a workstation connected to a domain?
>>> What version of XP and what service pack level? Are you the domain
>>> administrator?
>>
>> It's for XP Professional SP2. FWIW I'd like to know the answer in the
>> case of a standalone m/c and a box connected to a domain (and whether
>> or not I'm the domain administrator). Thanks for distinguishing those
>> scenarios.
>
> Well, of course you can change permissions. If you have a standalone
> machine running XP Pro (as you do), you can set very fine-grained
> permissions by using the Group Policy Editor.
>
> Start>Run>gpedit.msc [enter]
>
> You need to be logged in with an account with administrative privileges.
> If you want to know more about the Group Policy Editor, then type that
> into XP's Help & Support. Be careful working with the Group Policy
> Editor; it is completely possible to lock yourself out! There is also a
> newsgroup for the Group Policy Editor if you have specific questions
> about it:
>
> microsoft.public.windows.group_policy
>
> If you have a workstation joined to a domain, permissions are usually
> set at the domain level and although there may be a local administrator
> for emergencies, normally regular users would not be able to log in as
> local administrator or set/change permissions on the domain
> workstation. One of the reasons for running a domain is to have central
> control of the workstations.
>
> If you want to know more about domain set up and best practices, this is
> a vast subject. I suggest starting with TechNet, which is a marvelous
> resource:
>
> http://technet.microsoft.com/default.aspx
>
> Malke
> --
> Elephant Boy Computers
> www.elephantboycomputers.com
> "Don't Panic!"
> MS-MVP Windows - Shell/User
!