Using Same Account as both Admin and Limited User

It almost always is better to simply use one account for administrator only
activity and then another regular account for everyday use. That way you are
much less likely to forget to demote your regular account if you had
elevated it to administrator access because the account you use for
administrator access will have an obviously different user profile with
different desktop, favorites, etc.

Steve


"Walter Mingle" <walt.DeleteThis@no.email.invalid> wrote in message
news:d03s55hqj37s6r1lqgcmgcc8slioqqu54l@4ax.com...
> Hi,
>
> Is there any reason I shouldn't use an account as an Administrator to
> install programs, and do other things that require Admin privileges,
> and downgrade that same account to Limited User for every-day web
> surfing, e-mail, newsgroups, etc.? I'm trying to avoid the permission
> trouble that comes from a LUA running programs installed a another
> account.
>
> If this isn't the way to do it, how else can it be done? I'm using XP
> Home (SP3).
>
> Thanks for any advice.
>
> Cordially,
>
> Walt

On Wed, 15 Jul 2009 11:46:36 -0700, 1PW <barcrnahgjuvfgy RemoveThis @nby.pbz>
wrote:

<snip>

>By forgetting to return to a less privileged user mode, from Admin,
>one lays the system open to well known security risks.
>
>For the basic safety of your system, use the admin account for as
>short a time as is needed to tend to security and system related
>chores. When those chores are done, return to a less privileged user
>account. Avoid giving user accounts more privilege then needed.

Hi Pete,

I think I understand the security precepts you mention, and I agree
with them - that's why I'm interested. What I'm really asking: is
there any technical reason why I should stick with separate Admin and
Limited accounts, rather than changing one single account back and
forth as needed? In other words, does the mere act of upgrading a
limited account to Admin, and then returning it back to limited status
alter the permissions that a limited account should have, as you
mentioned above? I'm not technically knowledgeable enough to know the
answer.

>Congrats at being at SP3! Here's hoping all your other security is
>excellent.

NAT router, Windows firewall, BitDefender and Safe Hex <g>.

>Pete

Thanks, Pete.

Walt

Walter Mingle wrote:
> On Wed, 15 Jul 2009 11:46:36 -0700, 1PW <barcrnahgjuvfgy RemoveThis @nby.pbz>
> wrote:
>
> <snip>
>
>> By forgetting to return to a less privileged user mode, from Admin,
>> one lays the system open to well known security risks.
>>
>> For the basic safety of your system, use the admin account for as
>> short a time as is needed to tend to security and system related
>> chores. When those chores are done, return to a less privileged user
>> account. Avoid giving user accounts more privilege then needed.
>
> Hi Pete,
>
> I think I understand the security precepts you mention, and I agree
> with them - that's why I'm interested. What I'm really asking: is
> there any technical reason why I should stick with separate Admin and
> Limited accounts, rather than changing one single account back and
> forth as needed? In other words, does the mere act of upgrading a
> limited account to Admin, and then returning it back to limited status
> alter the permissions that a limited account should have, as you
> mentioned above? I'm not technically knowledgeable enough to know the
> answer.
>
>> Congrats at being at SP3! Here's hoping all your other security is
>> excellent.
>
> NAT router, Windows firewall, BitDefender and Safe Hex <g>.
>
>> Pete
>
> Thanks, Pete.
>
> Walt

Hello Walt:

Steve's post is spot on. Words to live by.

Regards,

Pete
--
1PW @?6A62?FEH9:DE=6o2@=]4@> [r4o7t]

Walter Mingle wrote:

> Is there any reason I shouldn't use an account as an Administrator to
> install programs, and do other things that require Admin privileges,
> and downgrade that same account to Limited User for every-day web
> surfing, e-mail, newsgroups, etc.? I'm trying to avoid the permission
> trouble that comes from a LUA running programs installed a another
> account.
>
> If this isn't the way to do it, how else can it be done? I'm using XP
> Home (SP3).

The Administrator account should never be touched except in case of
emergency. Create a new alternate admin account that you use for
installing software, creating user accounts, and other admin duties.
Make your own account a limited or power account. You don't want to end
up with a corrupted Administrator profile and have it as your only
admin-level account that is no longer usable (a corrupted can be fixed
but requires some work). You could also use the alternate admin account
as a backup and use the Administrator account as your regular admin-
level account; however, most recovery instructions will assume you are
using the Administrator account and you could forget what is the name of
the alternate admin account if you use it rarely.

You can either logoff your own limited account and logon under the
alternate admin account, or you can use Fast User Switching to flip
between the two.

For Internet-facing applications, you can run them under a LUA (limited
user account) token which removes the admin privileges from them. They
run with the same reduced privileges as when you run them after logging
under a limited account. You can use DropMyRights. I use SysInternals'
psexec to run a program under a LUA token. TallEmu's OnlineArmor has
its RunSafer attribute that you can assign to applications to run them
under a LUA token; however, I ran into some personal dislikes with OA
(see my posts in their forums) and decided to stop using it, but
periodically I revisit the product to see if they fixed my problems with
it because I really like logging under an admin account but have some
programs always run under a LUA token (you can easily use their tray
icon to temporarily disable their Program Guard when you need, say, the
web browser to be unlimited, like when using the Windows Update site).

On Wed, 15 Jul 2009 21:08:12 -0500, VanguardLH <V.RemoveThis@nguard.LH> wrote:

>The Administrator account should never be touched except in case of
>emergency. Create a new alternate admin account that you use for
>installing software, creating user accounts, and other admin duties.
>Make your own account a limited or power account. You don't want to end
>up with a corrupted Administrator profile and have it as your only
>admin-level account that is no longer usable (a corrupted can be fixed
>but requires some work). You could also use the alternate admin account

<snip rest>

Ok. Nobody likes my idea of switching the same account back and forth
between elevated and limited as needed, so I'll give up on that idea.

I wasn't planning on using the real Administrator account (the one
that lives in Safe Mode in XP-Home) - I would have used a regular user
account with admin privileges for that.

Many thanks to all who answered - I *really* appreciate the time you
folks took.

Sincerely,

Walt

Look for a script callled MakeMeAdmin.

BTW, I have long thought that what you say is correct. The lack of
understanding, if any, lies in people who insist on applying 1960's
shared-access mainframe principles to a personal computer.

What is actually needed on a one-per-desk computer is a way to prevent
access to system files when in 'normal mode' so as to offer better security
against malware, and to allow such when in 'maintenance mode.'

What happens instead is that all system configuration is done under an
entirely different collection of settings, and any changes to the settings
are thrown-away when returning to normal mode. This causes extreme
awkwardness (in fact it means that most apps have to be configured
twice-over) and is the main reason most people don't run as a limited user.

As Zaphod Beeblebox would point out, two heads which constantly disagree are
not necessarily an advantage over one.

"Walter Mingle" wrote:

> Hi,
>
> Is there any reason I shouldn't use an account as an Administrator to
> install programs, and do other things that require Admin privileges,
> and downgrade that same account to Limited User for every-day web
> surfing, e-mail, newsgroups, etc.? I'm trying to avoid the permission
> trouble that comes from a LUA running programs installed a another
> account.
>
> If this isn't the way to do it, how else can it be done? I'm using XP
> Home (SP3).
>
> Thanks for any advice.
>
> Cordially,
>
> Walt
>