Admin Rights

I have only 1 account which is the admin one but is it safer to make a norma lone with "guest" rights and login with that one when doing normal tasks? kinda like with mac osx? or does that not work on xp like with mac osx and upcoming vista?

 

Well, you might run into issues when installing software. Actually, if you look when making a new account, there are several account types that many people do not talk about. I would check to see what each one restricts. It is definately recommended to use an account aside from the Admin account for everyday use. That way, if you ever need to debug the machine, you have a "germ-free zone" that doesn't have an abundance of startup files and services.

 

You could, however most people don't as it can be a nuisance. You'll have to log onto an admin account when installing most things, and certain apps won't work properly (rare).
Also I think limited account might not be able to access the entire drive (not sure though, I'm always on admin).

 

so basically atm with windows xp not a huge benefit, unlike upcoming vista and currently mac osx where its highly recommended to not use your admin account?

 

I would highly recommend against using the main Administrator account. Create a separate account...however, if you give that account the exact same privilages there really will be no benefit. I would check on the variety of account types... I know there are more than 3 for sure.

 

A lot of programs (especially games) will object to being run without adminstrator privileges.

Windows XP isn't very well thought out in this respect, and using a non-admin account is pretty difficult and frustrating. (Unless you never plan to install new software).

The best compromise is usually to 1) set a password on the Administrator account (A hacker knows that an account named "Administrator" exists, so if that one is not passworded, you're running a bit of a risk)
Then create a new account with administrator privileges, and use that for everyday use.

If you really want to be able to work without admin privileges, switch to another OS.

 

so i need them both passworded? or just the default admin one? does having them passworded actually protect you more?

 

Well, the most important thing is to have the "real" Administrator account passworded, because that's the first account anyone will try to get into.

Of course, having the account you actually use passworded as well is better than not doing it. But that is less important than the main admin account.

 

I have a passworded admin acct that I use most often and the limited guest account in case a roommate needs to use my comp. That way, they won't download and install crap on my computer.

 

That is not exactly the case. Yes you should passwrod every account, but if you are browsing the web and get infected by spyware, you will already be in an Admin account and that program will have Admin rights.


The reason you want to run limited is because you can't install stuff. So, most vulnerabilites are neutered this way. Spyware and viruses have don't have a chance to get their hooks in because they only have limited rights. Unfortunately, as Jalf said, Windows XP was not designed as a multi-user OS, it was more of an after thought, and most programs won't like being in a limited account. Plus there is no easy Authentication process from within a limited account. This is one of the big reasons XP is so insecure. Vista fixes this somewhat, but I have heard that it is more superficial and less structural. Time will tell.

 

Yep, but if the standard administrator account is passworded, that's still one less potential source of attacks. (If a hacker, or even a guy who just sits down at your computer when you're away, wants to get into your computer, the first thing he does is try to get access through the administrator account, because he *knows* that one exists. And if that one isn't passworded, well, it's hardly a major challenge...

Of course, as said above, none of this protects you against spyware or viruses, which can in turn open up countless vulnerabilities and back doors.

 

Very true, I 100% agree. It should also be noted that ALL default paswords whould be changed, especially your router's.

 

how do I password the harddrive? I want to set my computer so that it will not boot up without a password. Do I have to download a program to do that? Is it in the BIOS?

 

I am unsure how to do that, I am certain someojne can tell you. be sure to write that password down somewhere though. You really don't want to forget what it is!

 

Go to the BIOS at startup F2 when you restart then go to System Security and setup the password but as cashmonee said don't forget/lose it i believe you have to do something physical to your computer to bypass it, in the event you ever forgot or lost the password i forget what it is though.

 

Hit it with a bat and send it in under warranty?

No worries, I won't forget. I'm like an elephant, except much better looking.

 

The physical aspect would involve either accessing the jumper switch on the motherboard (a pain to get to in the first place) or if you're lucky, just removing the RTC battery for a minute and slipping it back in should be enough to remove the BIOS password. The latter worked for me on my hp dv5000. The RTC is located in the memory compartment behind the integrated wireless card, so I had to take out the card first.

 

IMO, you should create another normal "User" account. It's much safer. If you want to install something, right click on setup.exe and choose "Run As", if it's not there then use Shift + Right Click. And for things that don't run well in your user account just use Run As.

 

i think you'll last about a week before you get sick of using a BIOS password.

all you need is one account on your computer, the admin account. just change the name of the account and password it. turn off the guest account. the end.

if you're that concerned about security, you shouldn't be keeping your data on a notebook that can be stolen, it should be archived offline somewhere.

 

I had a question about this too... I am going to be giving my computer to my parents so that they can lend it to one of their coworkers to work on. I have a fair bit of personal documents/other files on the computer that appear in the "program files" folder which appears on te C drive. How can I restrict users to access the C drive then? they will only be using MS Office and IE...

 

If you don't want to erase everything you could just encrypt it with something like TrueCrypt.

 

that program looks pretty interesting....

is it hard/annoying to use though? it says it saves everything in RAM and only updates the HD when it shuts down/restarts the computer.... I can see that being a problem if theres a sudden failure/freeze.

what i wanna do is take my computer, and create an account where the person can neither see what i have installed (HL2, Halo, etc) nor access the directories except "my documents". even with "limited access" user tehy can easily play HL2 if they wanted to.

 

In Windows it can be difficult. You could create a limited account and then hide your folders, but it is not too difficult to get around that. If all you are looking for those is out of sight out mind, that wil probably do the trick.

 

Which OS do you have ? XP Home, MCE or Professional ? If you have XP professional, you can use group policy to restrict access to resources. If you are using XP home or MCE, there are several third-party software out there to enforce group policy. You can create accounts with restricted priv and even disable "boot from USB devices", control startup, restrict access to folders, programs etc.

If you are sharing your machine with others, make sure you give them a non-admin user account "only adequate access to resources - don't give too much and don't give too little".