Creating a super restricted user account

Hi All,

Whenever I go into a computer lab or an internet cafe, most computers have accounts that are super limited (e.g. can only use IE and maybe office), and often erase all new settings/passwords, etc. upon logout.

Do you guys know how to do this in vista? e.g. create an account so that users can't possibly mess around with settings or leave any lasting damage? OS is home 32bit.

Thanks a bunch!

I would simply opt to not let them anywhere near my PC....

thats a stupid response. ^^

i was wondering the same thing, and although you can limit what a user has access to (they will immediately be able to install any programs you have on your side) you can simply delete and/or uninstall them from the limited access users side. as simple as that. and they will only have access to whatever you leave available.

however, extra drives, etc, you can't block (i have a TON of music stuff - i write music) and didn't want my girl to have access to it in case she accidentally erased something, but near as i can tell, that just isn't possible.

she could easily go in and format one of the other drives or mess stuff up. but again, as far as programs, she's only got access to what i have left in the account.

It is possible! As long as your drive was formated as NTFS you can set the security permissions to restrict access to certan files / folders easily.

All you do is find the drive / folder / file you want to limit access to, right click on it and go to properties, click on the security tab, and there you can add / remove user accounts that can modify / view that file. You can get fairly grainular in the type of access you want them to have.

If you don't see the security tab you have to disable "Simple File Sharing" by opening "Computer" and clicking on "Tools" at the top (if you don't see it, try hitting the ALT key) then click on "Folder Options". When that window pops up choose the middle tab and one of the last options listed should be "Use Sharing Wizard"... uncheck it.

Oops, sorry Falcon, I didn't respond to your orignal post!

So what you are looking for is something called a "Mandatory Profile". What you would do is set up the profile in question exactly how you want it (program access, background, desktop, etc), log out, log in with an administrator account, navigate to C:\Users\USER where USER is the username of the user you want to limit, look for a file called ntuser.dat and rename it to ntuser.man.

If you don't see ntuser.dat your probably don't have viewing of hidden files and folders available. It is done in the same way as I described above to disable the "Use File Sharing Wizard" options, but there is an option in that same screen to show hidden files and folders.

In XP you have gpedit.msc maybe something similar in Vista, in XP gpedit.msc locks down most things at work we can't even open display properties!

I don't think my response was silly at all...

You wouldn't leave a kid play in a car incase they did something wrong.

Same as with a PC that has very important files.

You either educate the child or prevent them access.

If you have to spend a lot of time fiddling with very restrictive account settings it's easier to just educate or bann completely.

or better still.... buy a cheap second hand laptop and let the child use that.

I think this is a good idea get one with an easy restore disc and keep files on USB pens.

I would recommend Windows SteadyState ... functionality is better described in last issue of technet magazine - here. Unfortunately Vista is not supported yet

On a similar note I've been looking for a quick way to launch programs with reduced privileges. I tried RunAsLimitedUser on my XP machine(which is the guinea pig before I put stuff on the Vista PC) and I got "engine init failed" 4 out of 5 tries. Even the XP RunAs where you check "protect my files.." does the same thing so I'm not sure what's wrong. I'm trying to find something short of setting up Virtual Box but there aren't many alternatives that are free.