Creating a super restricted user account

Hi All,

Whenever I go into a computer lab or an internet cafe, most computers have accounts that are super limited (e.g. can only use IE and maybe office), and often erase all new settings/passwords, etc. upon logout.

Do you guys know how to do this in vista? e.g. create an account so that users can't possibly mess around with settings or leave any lasting damage? OS is home 32bit.

Thanks a bunch!

I would simply opt to not let them anywhere near my PC....

thats a stupid response. ^^

i was wondering the same thing, and although you can limit what a user has access to (they will immediately be able to install any programs you have on your side) you can simply delete and/or uninstall them from the limited access users side. as simple as that. and they will only have access to whatever you leave available.

however, extra drives, etc, you can't block (i have a TON of music stuff - i write music) and didn't want my girl to have access to it in case she accidentally erased something, but near as i can tell, that just isn't possible.

she could easily go in and format one of the other drives or mess stuff up. but again, as far as programs, she's only got access to what i have left in the account.

however, extra drives, etc, you can't block (i have a TON of music stuff - i write music) and didn't want my girl to have access to it in case she accidentally erased something, but near as i can tell, that just isn't possible.

Click to expand...

It is possible! As long as your drive was formated as NTFS you can set the security permissions to restrict access to certan files / folders easily.

All you do is find the drive / folder / file you want to limit access to, right click on it and go to properties, click on the security tab, and there you can add / remove user accounts that can modify / view that file. You can get fairly grainular in the type of access you want them to have.

If you don't see the security tab you have to disable "Simple File Sharing" by opening "Computer" and clicking on "Tools" at the top (if you don't see it, try hitting the ALT key) then click on "Folder Options". When that window pops up choose the middle tab and one of the last options listed should be "Use Sharing Wizard"... uncheck it.

Oops, sorry Falcon, I didn't respond to your orignal post!

So what you are looking for is something called a "Mandatory Profile". What you would do is set up the profile in question exactly how you want it (program access, background, desktop, etc), log out, log in with an administrator account, navigate to C:\Users\USER where USER is the username of the user you want to limit, look for a file called ntuser.dat and rename it to ntuser.man.

If you don't see ntuser.dat your probably don't have viewing of hidden files and folders available. It is done in the same way as I described above to disable the "Use File Sharing Wizard" options, but there is an option in that same screen to show hidden files and folders.

In XP you have gpedit.msc maybe something similar in Vista, in XP gpedit.msc locks down most things at work we can't even open display properties!

I don't think my response was silly at all...

You wouldn't leave a kid play in a car incase they did something wrong.

Same as with a PC that has very important files.

You either educate the child or prevent them access.

If you have to spend a lot of time fiddling with very restrictive account settings it's easier to just educate or bann completely.

or better still.... buy a cheap second hand laptop and let the child use that.

Clevo said:

buy a cheap second hand laptop and let the child use that.

Click to expand...

I think this is a good idea get one with an easy restore disc and keep files on USB pens.

I would recommend Windows SteadyState ... functionality is better described in last issue of technet magazine - here. Unfortunately Vista is not supported yet

On a similar note I've been looking for a quick way to launch programs with reduced privileges. I tried RunAsLimitedUser on my XP machine(which is the guinea pig before I put stuff on the Vista PC) and I got "engine init failed" 4 out of 5 tries. Even the XP RunAs where you check "protect my files.." does the same thing so I'm not sure what's wrong. I'm trying to find something short of setting up Virtual Box but there aren't many alternatives that are free.

Go to "control userpasswords2" and set his account as guest. This will lock him out of anything that will damage the computer, from the inside anyway.

Goodluck,
Fmjc001

Hi Fmjc,
Again, do not you think that since january this problem is solved ?

sidney1st said:

Hi Fmjc,
Again, do not you think that since january this problem is solved ?

Click to expand...

I was just explaining how to do it an easier way, other people might be trying the same thing.

Sorry,

falcon9202 said:

Hi All,

Whenever I go into a computer lab or an internet cafe, most computers have accounts that are super limited (e.g. can only use IE and maybe office), and often erase all new settings/passwords, etc. upon logout.

Do you guys know how to do this in vista? e.g. create an account so that users can't possibly mess around with settings or leave any lasting damage? OS is home 32bit.

Thanks a bunch!

Click to expand...

I'm not a big fan of NetWare... but they have excellent tools for doing this sort of thing. However, I don't know if they have anything for a standalone/home computer. But that might be a direction to look into.

Matajon said:

I would recommend Windows SteadyState ... functionality is better described in last issue of technet magazine - here. Unfortunately Vista is not supported yet

Click to expand...

+1 For SteadyState. I have an account that I have set to remove all changes at restart. I use it for testing out programs.

When you say it's not supported by Vista, do you mean x64? I use it on my 32 bit Vista machine.

The install notes show the following (emphasis added by me):

Windows SteadyState works with genuine versions of Microsoft Windows XP with SP2 or SP3 installed, Windows Vista, and Windows Vista SP1. SteadyState works on 32-bit versions for the following operating systems: Windows XP Professional, Home Edition, and Tablet PC Edition are supported, as well as Windows Vista Business, Enterprise, Ultimate, Home Basic, Home Premium, and Starter. The hardware requirements are the same as for Windows XP and Windows Vista, so any computer that runs these operating systems well should also be able to run Windows SteadyState.

So it would seem that it is 32bit only.