Abilities of a "standard user" (vs. an admin user) 1

[DayLaborer]

I tried Googling this but couldn't find the answer...

I am creating "standard user" accounts for my kids on our home PC (Windows 7 Home Premium). I do understand that "standard users" cannot un/install software. That's good. But can they delete, let's say, files/folders from (for example) the Program Files folder? In other words, do I need to use NTFS permissions to deny them from modifying all such "important" files, or will their "standard user" accounts take care of that for me? Also, if I deny the ability for them to modify/write on the whole drive (except for their stuff), I think some of their programs won't work properly...

Advice?

Thanks,
Eliezer

 

[vacunita]

Standard Users should not have the ability to modify or delete files in Operating System protected folders such as Windows, Users, and Program Files.

Only Read and Execute permissions.

You can actually confirm that by Right Clicking on the folder in question, and choosing Properties, then clicking on the Security tab. The Users group should only have 3 permissions checked:

Read & Execute
List Folder Contents
Read

That means the can see the contents, they can execute programs from there, but thy can;t delete in or write to those folders.

----------------------------------
Phil AKA Vacunita
----------------------------------
Ignorance is not necessarily Bliss, case in point:
Unknown has caused an Unknown Error on Unknown and must be shutdown to prevent damage to Unknown.

 

[DayLaborer]

Thanks, Vacunita. Are you aware of anywhere where this is documented, e.g. exactly what the restrictions are of standard users?

Thanks,
Eliezer

 

[vacunita]

It refers to Windows Vista, but applies to Windows 7 as well.

http://technet.microsoft.com/en-us/library/cc709628(WS.10).aspx

It has a table that lists what Standard and Administrators can do.

Admins can do everything Standard Users can do plus everything on their side of the table.



----------------------------------
Phil AKA Vacunita
----------------------------------
Ignorance is not necessarily Bliss, case in point:
Unknown has caused an Unknown Error on Unknown and must be shutdown to prevent damage to Unknown.

 

[linney]

Programs written for Vista and Windows 7 should not be a problem for the Standard User once they are installed. Old programs written for XP and earlier may have .dat, .log, .txt, .ini, and .exe files stored in the Windows folder, System32 folder, or the Programs Files folder, and also have entries in the the Registry. A user with Standard rights would have difficulty writing to such files or Registry Keys.

This can be overcome via the use of "elevation", that being running under an Administrator Account by right-clicking on the .exe (or shortcut) and selecting the "Run As Administrator" option, which requires knowing an Administrator's password, or you have to change the access permissions of all the relevant files so that a Standard User can access them.

HOW TO: Take Ownership of a File or Folder in Windows XP (or Vista)

http://support.microsoft.com/kb/308421/en-us

Error Message: "Access Is Denied" When You Try to Open NTFS File System Folders

http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q823306#appliesto

A couple of XP articles but still relevant. Some of the examples apply to Domains but you'll get the idea, I hope.

How inheritance affects file and folder permissions

http://technet2.microsoft.com/windo...1277-48da-b321-be7c5dd317091033.mspx?mfr=true

Set permissions for folders and files

http://www.microsoft.com/windowsxp/using/networking/security/permissions.mspx#top

 

[DayLaborer]

Linney, I'm not worried about standard users, e.g. kids, being able to successfully use programs. I'm trying to protect the files on my PC from them.

Vacunita, thanks for the link, but I'm looking for a list of which folders/files are "safe" from standard users.

Thanks,
Eliezer

 

[vacunita]

Those 3 and their sub-folders are it.

Program Files
Users
Windows

In the "Users" folders the documents folder belonging to the current user is of course available to the user. So they can add, remove, delete, copy etc.. files and folders from withing that specific folder.

Anything else under the "Users" folder is Protected.

Any folder inside any of these folders is Protected.

Unless specifically set to not be by an Admin user.


----------------------------------
Phil AKA Vacunita
----------------------------------
Ignorance is not necessarily Bliss, case in point:
Unknown has caused an Unknown Error on Unknown and must be shutdown to prevent damage to Unknown.

 

[DayLaborer]

Thank you, Vacunita!