Admin and Standard User Accounts

Topic

New Reply

I have a couple of quick questions about setting up a new standard user account that I thought I’d post here in a new thread to follow up on the Win 7 discussion here.

I only have an admin account on my Win 7 laptop and am going to set up a standard account for everyday use.

My first question – I don’t remember if I ever set up a password for this admin account. Is there a way to tell? I don’t want to create a new account and then not be able to get back into this first one if there is a password involved that I have forgotten about.

When I first start Windows, it goes directly to my admin account – not to the interface page to choose an account or input a password, so does that mean that there is no password?

My second question – can I set up other admin and standard accounts without passwords for those as well? I am the only user of this laptop and it never goes anywhere, so I’d rather not have any passwords if that’s possible.

Thanks for the help – just wanted to check before I started down this road and ran into an issue.

1 user thanked author for this post.

Myst

Reply | Quote

Replies

If on startup you aren’t seeing a screen with two or more options of which user account to use and aren’t prompted for a password, then you are on one main admin account that isn’t password protected. To set up a standard user account refer to our posts, you’ve provided that link, https://www.askwoody.com/forums/topic/whos-still-using-win-7/ where you list the proper procedure in creating a password protected admin account along with a standard user account that will become your main hub for use with the Win7 laptop.

Also, here is a step by step list of that set up. You can create multiple standard user accounts and it’s your choice whether you want to apply a password to one or any of those accounts.

Set Up a New Account with Standard Privileges
1. From the Start menu, choose Control Panel, and then click Add or remove user accounts.
2. Click Create a new account.
3. Enter a name for the account, and then select Standard user.
4. Click Create Account.
5. Close the window

MacOS, iOS, iPadOS, and SOS at times.

2 users thanked author for this post.

LHiggins, Cybertooth

Reply | Quote

Myst wrote:

If on startup you aren’t seeing a screen with two or more options of which user account to use and aren’t prompted for a password, then you are on one main admin account that isn’t password protected.

Thanks so much – that was what I was looking for! I didn’t think there had ever been a password, but I didn’t want to get started and then be asked for one that I couldn’t remember-  LOL!

Thanks for the steps, too! Much appreciated!

 

1 user thanked author for this post.

Myst

Reply | Quote

LHiggins wrote:

My first question – I don’t remember if I ever set up a password for this admin account. Is there a way to tell?

@LHiggins, one surefire way to tell if you have a password for your account is to open the Start menu and click on the icon that sticks out the top edge of the right panel. This will open a new window with the title, “Make changes to your user account”. If the first line below that title reads “Create a password for your account”, then you don’t have a password.

 

Keep Running Windows 7 Safely for Years to Come  
Make Windows 10 look and work like Windows 7

2 users thanked author for this post.

Myst, LHiggins

Reply | Quote

Great – thanks! That is exactly what it says, so there is no password. Whew – I was afraid there was one hidden somewhere, and I had no idea what it was!

So – I can create other accounts without passwords as well, correct?

Thanks again!

1 user thanked author for this post.

Cybertooth

Reply | Quote

LHiggins wrote:

So – I can create other accounts without passwords as well, correct?

Yup, you got that right! (As far as I know.  🙂 )

You’ll just need to select which account to go into when rebooting, as @Myst pointed out, but no password will be requested if you haven’t set one up for the account you’re going into.

 

Keep Running Windows 7 Safely for Years to Come  
Make Windows 10 look and work like Windows 7

2 users thanked author for this post.

LHiggins, Myst

Reply | Quote

I found this very useful for Windows 10, although it says Windows 7:

https://www.askwoody.com/forums/topic/creating-and-using-a-standard-user-account-on-windows-7/

On permanent hiatus {with backup and coffee}
offline▸ Win10Pro 2004.19041.572 x64 i3-3220 RAM8GB HDD Firefox83.0b3 WindowsDefender
offline▸ Acer TravelMate P215-52 RAM8GB Win11Pro 22H2.22621.1265 x64 i5-10210U SSD Firefox106.0 MicrosoftDefender
online▸ Win11Pro 22H2.22621.1992 x64 i5-9400 RAM16GB HDD Firefox116.0b3 MicrosoftDefender

1 user thanked author for this post.

LHiggins

Reply | Quote

[wavy]

see
Control PanelUser AccountsUser AccountsManage Accounts
You can very well not have a password prompt and be password protected if using auto login.

🍻

Just because you don't know where you are going doesn't mean any road will get you there.

• This reply was modified 3 years ago by wavy.
• This reply was modified 3 years ago by wavy.

1 user thanked author for this post.

LHiggins

Reply | Quote

Cybertooth has already established a way to confirm whether or not an admin account is password protected. If Auto Login has been set up, when you go to manage the user account or make changes, it should be obvious if there is an existing password.

Cybertooth wrote:

one surefire way to tell if you have a password for your account is to open the Start menu and click on the icon that sticks out the top edge of the right panel. This will open a new window with the title, “Make changes to your user account”. If the first line below that title reads “Create a password for your account”, then you don’t have a password.

MacOS, iOS, iPadOS, and SOS at times.

2 users thanked author for this post.

Cybertooth, LHiggins

Reply | Quote

Quick update – thanks to everyone’s help, I did set up a new standard account without a password, and so far, both that and my admin account are accessible – no passwords needed.

Where I ran into an issue – and I think this is whereI got tripped up the first time I tried this a while back – is there doesn’t seem to be a way to access my Windows Live Mail account that I use as an admin user and run it in the standard account. When I click on the WLM, it opens a page of details about WLM and asks me to agree and download it – which I know it not possible now since that program is no longer available.

So – it seems my other choice is to run Thunderbird in the standard account and import mail back and forth that I may need from one user account to the other. I do have TB set up in the admin account, but don’t use it – so I’ll need to look into importing that profile over to the standard account so at least they will be somewhat synced.

I also haven’t tried it yet, but I have Firefox set up to sync, so I think I can just sync the FF in the standard account to the one in the admin account and it should all work.

Thanks to all for the help with the set-up. I’ll check back with progress on TB if I can get that working.

Have a great weekend and Happy Labor Day to those in the US, too!

1 user thanked author for this post.

Myst

Reply | Quote

A better way to do it is to set up a new account as the administrator, make sure you can log into it, then change your normal account to a “standard” account. Then continue using your normal account as you have been. Everything will work exactly as it has been working, except that whenever something tries to install, it will prompt you for the password on the administrator account. Once you enter the password, the install will proceed as normal.

I strongly suggest setting up a password on the administrator account. This will give you control when an install or some other admin-level action tries to take place.

By continuing to use your normal account as a “standard” account, you wouldn’t have had the problem with your Windows Live Mail account. You can still set things up that way; and if you do, your problem with Windows Live Mail will disappear.

Group "L" (Linux Mint)
with Windows 8.1 running in a VM

1 user thanked author for this post.

LHiggins

Reply | Quote

Thanks for your advice – which I know you have given me several times before! I feel like I’ve been around this block a few times, but just can’t seem to take that last step – so I appreciate you being willing to keep advising me!

I believe that this time, I am ready to take your advice – with a few questions if I may.

1. Before doing anything, I’ll make a restore point and a full Macrium backup. Will either of these reverse any “damage” that I may do if things don’t work out with the switch of accounts? Can I use one or the other to revert back to the way things are now?
2. Or – if I have set up a successful second admin account – can that be used to reverse any changes to the original account back to admin from standard?
3. How will I be sure the new admin account works – log in and out a few times and see if I can see my current admin account from it? And how many admin accounts can there be?
4. Can I create a new admin account and a new standard account and see if using that new admin account, I can make changes to the new standard account – would that be a good way to test as well?
5. So I still be able to install software on the admin-now-standard account by using the admin password?

Thanks so much for the help and answers. I know I am making far more of a big deal about this than it should be – just pretty gun shy on getting into a situation that I can’t back out of!

Reply | Quote

1. The restore point is a good idea, but I’m not sure it could successfully reverse you back to before you changed the user accounts. That sort of “restore” is beyond the ability of Windows restore points. However, a full Macrium backup is able to do just that. It takes a complete “picture” of what is currently on your hard drive; then, when you do a restore using that backup, it exactly recreates the picture that it took when you did the backup.

2. You can use the second admin account to reverse your changes; but all reverses will be manual, not automatic; you will need to know what to do, and then do it. Also, if you by chance really messed something up (e.g. you deleted some critical files), you might not be able to reverse it even with an admin account.

3 & 4. You can set up as many admin accounts as you want to. I recommend that you set up two; in that way, in case one of them becomes inaccessible, you have the other one to rely on. To verify that it works, log in and out a few times; and do a few things when you are logged in, such as surfing the web, and changing the picture on your non-admin normal account. (Be sure to write down the password of each admin account; you’ll likely forget those passwords, because you don’t often log in as the administrator.)

5. Yes. When logged in on the standard account, if you try to install some software, it will ask you for the username and password of an admin account. Alternately, you can right-click on the setup.exe file (to do an install) and choose Run As, then select the administrator account. You will acquire admin rights for that one task only by doing so.

As for feeling gun shy about certain things, that is a sensible attitude. A good backup will protect you from mistakes, because it will allow you to reverse what you did. But how can you verify that your backup is good, other than restoring it and taking a chance on overwriting what you have with a bad backup? Here is one way:

You may have an old hard drive (at least five years old). Or your drive may be small; or you may have a mechanical drive that you want to upgrade to an SSD (solid state drive). Do a backup of your current drive, then restore to a new drive. Then boot the computer. If all is well, your backup was good; you can then store your old drive – it is now a full backup of your system at the time you replaced the drive.

If the price for a new drive isn’t too much, get two identical drives rather than one; and then swap the drives every time you do a backup:
* Back up the drive that is currently installed – save the backup to an external USB hard drive.
* Remove the current drive, and install the other drive (the identical one).
* Do a restore to the drive now in the computer.

You can now log onto Windows and test the backup by trying some things in Windows (surfing the web, working on a document, etc.). You will be able to verify the backup without overwriting your primary hard drive. And the drive you backed up, which is now out of the computer and stored away, is a full backup of the computer – you can easily “restore the last backup” simply by reinstalling that drive.

Do this drive swap every time you do a full backup of your computer, and you will always know that you have a good backup.

Group "L" (Linux Mint)
with Windows 8.1 running in a VM

1 user thanked author for this post.

LHiggins

Reply | Quote

Thanks so much for the detailed reply!

MrJimPhelps wrote:

3 & 4. You can set up as many admin accounts as you want to. I recommend that you set up two; in that way, in case one of them becomes inaccessible, you have the other one to rely on. To verify that it works, log in and out a few times; and do a few things when you are logged in, such as surfing the web, and changing the picture on your non-admin normal account.

So – here’s my plan. I’ll do the backups and then create 2 new admin accounts with passwords – one of which will become the primary admin once I change the current one to standard and one as a backup. I’ll also create one new standard account, and do my testing between those new accounts to be sure that both admins work – before I do anything else. As you note – surf, make simple changes, etc.

If all goes well, I’ll also try changing one admin to standard and back using the other one to make those changes.

After I’m sure things are working, I’ll then use the new primary admin to change the current admin to standard and hopefully that will work fine and I won’t need to try to move files or use TB in place of WLM.

I will make sure I have all passwords written down and stored so that I can refer to them when needed.

Does that sound about right?

MrJimPhelps wrote:

But how can you verify that your backup is good, other than restoring it and taking a chance on overwriting what you have with a bad backup?

I think I have questions about the backup plan that you described. I can ask them here, or start a new discussion if that might be better? I’m not sure I understand about swapping the backup drives – do you mean two external drives? Anyway – we can come back to that.

MrJimPhelps wrote:

As for feeling gun shy about certain things, that is a sensible attitude. A good backup will protect you from mistakes, because it will allow you to reverse what you did.

Thanks – this does all make me feel better, and hopefully I can get over the angst and just make the needed changes and have a more secure system.

Thanks again for the help! Much appreciated!

Reply | Quote

Make sure that you have a working admin account before you reduce your normal acct down to standard user. Once you reduce your account’s rights, you won’t be able to use that same account to do any admin tasks.

Group "L" (Linux Mint)
with Windows 8.1 running in a VM

1 user thanked author for this post.

LHiggins

Reply | Quote

Yes – I’ll make sure it is working before I do anything else – and as you suggested, I’ll make 2 to be sure!

Thanks! Will let you know how it goes!

Reply | Quote

OK – some progress and a few questions.

I created 2 new admin accounts and one new standard account. All seemed to work fine, and I could log in and out, look at web pages, and make changes to these accounts with the new admins, so I think that the admins are OK and working.

However, I’ve noticed something that I though I’d check on before going any further.

In my current admin user account that I’ve been using all along, the start menu looks like this:

and the folders in the users account for that account look like this:

Compared to both other admin accounts – they are different in the original account. Here’s one of the other admin’s start menu:

and the other user folders:

The original admin account has Administrative Tools as one of the start menu options – does that mean that account is different from a “regular” admin account – or can that choice be added to any admin account start menu?

And in the folders – my original admin shows AppData – greyed out, but I can access it. The new admin doesn’t show that – is there a way to get it to be visible and accessible?

On the plus side – I did get both Firefox and TB working in one of the new admins as a backup in case I want to use those from there.

Also – in my users folder, there are two older user accounts that I had tried to work with earlier. Both were standard, and one I know I had deleted – yet both are still there in the user folder. They do not appear as choices when I log in – only my original account and the new ones I created today are, and they are also not listed in the interface to make changes or delete them. So, can I just delete those folders since the accounts don’t really seem to exist? Or change the names to something I will be sure to ignore?

Thanks for the help! Just wanted to check these things before going further.

Reply | Quote

If I may add one to the discussion..

I am the only user of this laptop and it never goes anywhere, so I’d rather not have any passwords if that’s possible.

Unprotected Admin account seems not to be good idea for me. Even if you use your laptop alone, you still do things like internet banking, email checking and things like that? Consider this solution.

You can get rid of the password prompt by small program called autologon. You can download it from https://live.sysinternals.com/
This program allows your to log you in from the password stored in registry.

For setting Administrator password, press WIN+R and type
lusrmgr.msc
Management console will appear
1) rightclick Administrator
2) click “Set password” and confirm new password (type password twice)
3) rightclick Administrator again and click “Properities”
4) check field “password never expires”

This may seem like complicated way, but it makes your password valid forever this way.

Then run autologon and set up your login. PC will boot automatically, no password prompt, your PC is protected (but has password stored in registry), but MSFT has article about this too.
https://support.microsoft.com/en-us/help/324737/how-to-turn-on-automatic-logon-in-windows

Have a nice day.

Dell Latitude 3420, Intel Core i7 @ 2.8 GHz, 16GB RAM, W10 22H2 Enterprise

HAL3000, AMD Athlon 200GE @ 3,4 GHz, 8GB RAM, Fedora 29

PRUSA i3 MK3S+

1 user thanked author for this post.

LHiggins

Reply | Quote

doriel wrote:

Unprotected Admin account seems not to be good idea for me. Even if you use your laptop alone, you still do things like internet banking, email checking and things like that? Consider this solution.

Thanks for the suggestion and information on using autologon. Much appreciated!! Once I get the accounts sorted, I will look into it, since I will want to keep using the standard account for email, internet etc as you noted!

 

Reply | Quote

doriel wrote:

Unprotected Admin account seems not to be good idea for me. Even if you use your laptop alone, you still do things like internet banking, email checking and things like that?

Perhaps I am misunderstanding what you mean, but what difference would it make if the admin account did or did not have a password for those things? Once you’ve logged in, if you manage to get yourself infected and have malware running at the user level, it’s already past the gate. It would have come in from the internet, where the local password isn’t even in play.

The ability to really do damage is in getting ahold of the admin (root) access, and that doesn’t require a password by default in Windows. It requires the user to allow the action from the UAC prompt,  which is usually just a single mouse click. If there is an exploit that allows privilege escalation, it will be equally dangerous with or without a password.

I am the only user of all of my PCs, but I still use (and recommend) passwords at multiple levels… and some of them are annoyingly long, difficult to type things. One of those on my systems is the password to unlock the encrypted volumes, where all of the potentially sensitive data (like Waterfox/Firefox/Thunderbird profiles) are stored. It is necessary to type the password in at each boot, so it’s rather redundant to then have to type in my user password a few seconds later, so I’ve got it set up to autologin on my various PCs. If I am logged out or if the unit is put to sleep, the password will be required to resume or to log back in. The only time the user login is not required is immediately following the password challenge at boot for the encrypted volume.

The reason for this, even though I am the only user of my PCs, is that I cannot guarantee that they won’t be lost or stolen. These passwords are about limiting access by someone that has physical possession of the unit, not anything over the internet. Laptops are particularly easy to steal, of course.

It would be even better if I had the PC hibernate each time I closed the lid (instead of using sleep), forcing the use of the decryption password to restore the session, but I make some allowances for convenience, and there’s nothing that would give any would-be attacker the idea that there is anything on my PCs that is particularly interesting, like government or corporate secrets. I’m more concerned about a garden variety thief who is after the hardware, but who might do something with any personal data if it happened to be there.

Dell XPS 13/9310, i5-1135G7/16GB, KDE Neon
XPG Xenia 15, i7-9750H/16GB & GTX1660ti, KDE Neon
Acer Swift Go 14, i5-1335U/16GB, KDE Neon (and Win 11 for maintenance)

3 users thanked author for this post.

Myst, doriel, LHiggins

Reply | Quote

It requires the user to allow the action from the UAC prompt, which is usually just a single mouse click.

Thank you for your question and post. My thought is, that if no password is set, then malware can take control over your computer in some background process simply by using Administrator account with blank password. Am I mistaken? Maybe I am and if so, I will gladly accept correct information.

Dell Latitude 3420, Intel Core i7 @ 2.8 GHz, 16GB RAM, W10 22H2 Enterprise

HAL3000, AMD Athlon 200GE @ 3,4 GHz, 8GB RAM, Fedora 29

PRUSA i3 MK3S+

Reply | Quote

It should not be possible for a process running with user privileges do anything by itself to gain admin privileges, with or without a password on the account. I say “should” because no security schema is perfect, and the possibility of unknown bugs that could allow this is always there. If a process running at user level is able to escalate its own privileges without explicit permission from the user (through UAC in Windows or typing in the password in Linux), it’s an exploit, a security vulnerability that needs to be fixed.

Privilege escalation bugs do happen at times, and not just in Windows, but not setting a password on the Windows account should not make it easier for a process running at user level to gain admin privileges.  I can’t say that with certainty without knowing the nature of the unknown bug, which of course I can’t, because then it wouldn’t be unknown!

Dell XPS 13/9310, i5-1135G7/16GB, KDE Neon
XPG Xenia 15, i7-9750H/16GB & GTX1660ti, KDE Neon
Acer Swift Go 14, i5-1335U/16GB, KDE Neon (and Win 11 for maintenance)

3 users thanked author for this post.

doriel, LHiggins, Myst

Reply | Quote

For setting Administrator password, press WIN+R and type
lusrmgr.msc
Management console will appear
1) rightclick Administrator
2) click “Set password” and confirm new password (type password twice)
3) rightclick Administrator again and click “Properities”
4) check field “password never expires”

This may seem like complicated way, but it makes your password valid forever this way.

By default, no Windows password ever expires (unless forced via Group Policy by an admin).

How to force users to change their password periodically on Windows 10

1 user thanked author for this post.

doriel

Reply | Quote

Also this is suitable only for local accounts. Default setting probably is “Never expires”, but for me it is worth checking, since it takes 30 seconds.

Dell Latitude 3420, Intel Core i7 @ 2.8 GHz, 16GB RAM, W10 22H2 Enterprise

HAL3000, AMD Athlon 200GE @ 3,4 GHz, 8GB RAM, Fedora 29

PRUSA i3 MK3S+

Reply | Quote

I have No problem signing into my computer and even my google account. but I still have this:

On one pc we have a weird disappearing of passwords in Outlook and Chrome. These are the only apps that have passwords on this pc. This has been happening since about a week.
After putting the passwords again into the mail-accounts and Chrome and shutting off the pc we found that when the startscreen appears about half of the time there’s only the picture of a landscape with no text like: do you like this picture, and so on. The other time after a shutdown and restart the text shows up. In both instances the login screen appears after a click. No trouble with that.
Now, when there’s not any text on the startscreen, starting Outlook and collecting mail comes up with the windows asking for the passwords of the 2 accounts. Every time again. Doesn’t matter  whether “Saving password” is clicked or by putting it in at the mail setting in the control pannel to store the passwords.
On the contrary when the startscreen comes up WITH the info text Outlook seems to have stored the passwords, even after a previous start the passwords didn’t show up!

Chrome on the other hand keeps losing it’s passwords no matter what the windows startscreen looks like, text or not.

To me it looks like there’s something going wrong when starting Windows 10, but no idea what can cause that. Anybody? TIA

Whats’a really weird is that my other machine ( windows 10 pro ) has NO problem with Google Chrome remembering my saved passwords what so ever, unlike my windows 10 Home machine?????????????????

this all came with the Microfault 2004 big update?

Reply | Quote

Sorry, LHiggins, for this hijacking of your topic.

jessbell – On my Thunderbird (and Firefox too) I rarely have had something similar: ‘known good’ passwords are flaky. My solution has been to: delete the passwords for the affected accounts; verify (display passwords) that they are gone; and start over, re-specifying the correct string. In one case that I examined, there were multiple passwords for the same account, but corrupted one first. The re-entry (before deleting) went in below the bad one. The password-reading routine quit after hitting the bad one, which was higher in the list. Shouldn’t have happened, but it did. I don’t know if this will help you, though.

Reply | Quote

PaulK wrote:

Sorry, LHiggins, for this hijacking of your topic.

Hi Paul!

No worries – glad you had an answer for jessbell.

Reply | Quote

I think I have seen this issue before, someone mentioning it.. Cant remember when or why, I will try to find it and post it here, if I will be successfull. In the meantime, check Credential Vault for out-of-date stored passwords.

Dell Latitude 3420, Intel Core i7 @ 2.8 GHz, 16GB RAM, W10 22H2 Enterprise

HAL3000, AMD Athlon 200GE @ 3,4 GHz, 8GB RAM, Fedora 29

PRUSA i3 MK3S+

Reply | Quote

“You can get rid of the password prompt by small program called autologon. You can download it from https://live.sysinternals.com/”

There’s no need to download anything for that, because Windows already provides this facility – just enter NETPLWIZ and follow the prompts, to allow your username and password to be entered automatically at the login prompt.

Some discussion above about running something as Administrator when logged in as a normal user.  The opposite is also possible:  when logged in to an Administrator account, you may wish to run something with only “normal” user rights.  This can be done via a little program called StripMyRights.  For example, to run Firefox as a “normal” user, the command would be StripMyRights.exe /L N “C:\Program Files\Mozilla Firefox\Firefox.exe”

Windows 10 Pro 64 bit 20H2

1 user thanked author for this post.

LHiggins

Reply | Quote

I cant see any obvious way to set auto login via NETPLWIZ

Dell Latitude 3420, Intel Core i7 @ 2.8 GHz, 16GB RAM, W10 22H2 Enterprise

HAL3000, AMD Athlon 200GE @ 3,4 GHz, 8GB RAM, Fedora 29

PRUSA i3 MK3S+

Reply | Quote

Uncheck Users must enter a user name and password to use this computer

That check box will not appear if “Require Windows Hello sign-in for Microsoft accounts” is enabled at Settings, Accounts, Sign-in options (or if the computer is joined to a domain):

How to Automatically Sign in to User Account at Startup in Windows 10

1 user thanked author for this post.

doriel

Reply | Quote

[doriel]

Unfortunatelly, I have no checkbox in my Windows version 1809. As you stated, its because its joined in the domain. Thanks a lot, I always like to know new information.

Dell Latitude 3420, Intel Core i7 @ 2.8 GHz, 16GB RAM, W10 22H2 Enterprise

HAL3000, AMD Athlon 200GE @ 3,4 GHz, 8GB RAM, Fedora 29

PRUSA i3 MK3S+

• This reply was modified 3 years ago by doriel.

Reply | Quote

Quick question – can anyone tell me an example of something that can only be run from an admin account? And/or something that can be run from a standard account with admin privileges?

I think I have the different accounts sorted – have created 2 new admins and one new standard, and it seems I can access “everything” from the standard account by simply choosing one of the admins – a new one, not my current one to be sure that it works – in the UAC and going from there.

I guess my question – as a final test of the admin accounts – is there something that can only be accessed with admin privileges that I can try to run with both of the new admins to see if it does, and with the new standard, to see if it won’t or can be accessed? Downloading something perhaps, or another way to test them all?

I want to be sure that the admins work as admins but that I can access everything using the new standard, before I make the final switch.

Thanks!

Reply | Quote

Standard User is my everyday, search the Internet, write email, and download software, account.

I use Admin to do the installing. (Yes as Standard user you can install software, using the Admin account once you provide the Admin password.)

My example concerns downloading. I download software using the Standard account. I also send it up to Virustotal to check and if the Viurustotal scan was not recent, I scan using my current anti-virus using the Standard account.

I use the Admin account to move the software into Admin’s folder from Standard’s folder. Admin can access Standard user folder (give it permission on the first try then it becomes permanent). Admin can access Standard user’s download folder but Standard user cannot access Admin’s folder. Your proof will be to login as each user, to see the restricted access permission.

I have the second Admin account setup, in case I lockout the first Admin account and need to reset the first Admin’s password. (Sidebar: I am not a fan of Windows Folder Encryption because you need to have the encryption key pre-saved in case of encryption lock out.)

1 user thanked author for this post.

LHiggins

Reply | Quote

FYI, I use passwords on my accounts (except Guest account in Windows 7 and Windows 8.1).

1 user thanked author for this post.

LHiggins

Reply | Quote

Thanks for the replies!

KP wrote:

I use Admin to do the installing. (Yes as Standard user you can install software, using the Admin account once you provide the Admin password.)

So – does installing it using the Admin account make that program or whatever available to all users? If I installed it from the Standard account using the admin account permission, would it then only be installed in the standard account?

KP wrote:

Your proof will be to login as each user, to see the restricted access permission.

Do you mean the UAC request for the admin password – or something else?

Thanks again!

Reply | Quote

So – does installing it using the Admin account make that program or whatever available to all users?

My experience is exactly as you wrote. If I install SW with admin account logged in (I mean completely logged, not just UAC), then the SW is available for all users. Also, if Admin installs printer, it is also avalable for all other users.

Do you mean the UAC request for the admin password – or something else?

If you try to access folder you are not allowed to, the propt will appear, then password for designated account must be entered. see screenshots.

Dell Latitude 3420, Intel Core i7 @ 2.8 GHz, 16GB RAM, W10 22H2 Enterprise

HAL3000, AMD Athlon 200GE @ 3,4 GHz, 8GB RAM, Fedora 29

PRUSA i3 MK3S+

1 user thanked author for this post.

LHiggins

Reply | Quote

LHiggins wrote:

So – does installing it using the Admin account make that program or whatever available to all users?

It is going to depend on the Program. I do not install from Standard user. A few examples, Microsoft Office, Mozilla Firefox and Google Chrome are installed by Admin, and Standard User can use them. Some programs like Windows Defender and Google Chrome can even update from Standard User but I prefer to update using the Admin account and Restart the PC to check there are no problems.

I have used some programs where it needs to run under Admin, in which case I setup another Admin just to use with that program; and use it carefully because I have had my browser modified/hijacked running in Admin mode.

LHiggins wrote:

Do you mean the UAC request for the admin password – or something else?

I don’t usually install from the Standard User but if you do try to install from Standard account (and your Admin account has a password), the UAC request pops up for an Admin password. I think that is your question.

Maybe this is what you are asking. Login in as Standard user, you cannot install or access Admin’s file (once they have been moved to Admin’s folder). Login in as Admin and you can install and see Standard user’s folders/files (when you OK the permission). Admin’s ability to install, allows it to install malware hence use it only when necessary.

(You may have already noticed, I moved downloaded software into Admin’s folder to restrict access and to install from Admin’s folder.)

1 user thanked author for this post.

LHiggins

Reply | Quote

An idea, for your consideration:
When I download any program materials, whether I’m in Admin or Paul, I Save the file in Users\Public\Downloads\vendor-folder. For example, Firefox and Thunderbird Setup files go into C:\Users\Public\Downloads\Mozilla. My …\Microsoft folder has further sub-folders for additional organization. I prefer to run the installing EXE while logged onto Admin.

Regarding the question raised as to where an installed program is placed – whether it will be accessible only by the installing Standard user, or by everyone: As a general statement, programs issued in the last 15 or so years will install in ‘Program Files (x86)’ or ‘Program Files’, depending upon bit-versions (32 / 64). But, there are some ‘older’ programs that may automatically install in a user’s folder (e.g., Users\Paul\AppData\someplace.

2 users thanked author for this post.

doriel, LHiggins

Reply | Quote

[doriel]

But, there are some ‘older’ programs that may automatically install in a user’s folder (e.g., Users\Paul\AppData\someplace.

These are your personal files, that are used to configure programs. Each user has its own appdata folder, so for two users there exist two separate configurations. Different users on the same PC have different configs – example: GIMP for Paul will look different from GIMP for Admin – different theme, different default setting… On the same computer. Each user has opportunity to “personalize” SW for his needs.

Addition – if you install SW directly into AppData (which I do not do very often), it wont be available for others!

Dell Latitude 3420, Intel Core i7 @ 2.8 GHz, 16GB RAM, W10 22H2 Enterprise

HAL3000, AMD Athlon 200GE @ 3,4 GHz, 8GB RAM, Fedora 29

PRUSA i3 MK3S+

• This reply was modified 3 years ago by doriel. Reason: addition

1 user thanked author for this post.

LHiggins

Reply | Quote

Exactly! That is what I was getting at. I once was reviewing a computer: the user had installed a program in …\AppData\Roaming\something. It probably was an ‘older’ program whose installer didn’t know better. Program worked fine, as he was the only user.

Reply | Quote

PaulK wrote:

When I download any program materials, whether I’m in Admin or Paul, I Save the file in Users\Public\Downloads\vendor-folder. For example, Firefox and Thunderbird Setup files go into C:\Users\Public\Downloads\Mozilla.

Thanks PaulK – good suggestion!

And – I still have all of that TB info you shared with me last year – I actually did refer to it all when I was trying to set up TB in the new user accounts as a backup since WLM won;t run there. All worked as I remembered, and the notes you sent were great!

Reply | Quote

Thanks to everyone who has contributed to this discussion with great ideas and suggestions. I have tried most of them, and “think” I am convinced that I can safely change my current admin account to standard.

However – I do have a couple of questions before I pull the trigger. First – in all of my testing, I’ve just changed user and left my current admin as logged in – would that have skewed the results in any way? Here’s some of what I did:

I created 2 new admin accounts and one new standard. Using those in turn, I can log in and out of each, can change pictures and account types back and forth, see all folders in each account after passing thought the password dialog box, access and sync FF, set up TB as a backup in the new Admin #1, tested the printer in each, downloaded a small program in standard, and it is visible and usable in all accounts (more on that in a bit though).

But, after all of that, I guess I am still confused about using standard versus admin. I have found that in all accounts – even the new standard account, it seems I can “do” everything if I just grant admin access to that account in the UAC dialog. I haven’t run into anything that won’t let me grant myself access. I haven’t noticed if I see that UAC more in standard than admin – it doesn’t seem that way to me so far.

My confusion comes because currently in my admin account – it works that way, too. If I try to access something that needs the UAC to approve it, I get that dialog. It is a different dialog as it doesn’t ask me to choose an admin account – it just says that it needs permission to access. So – how is using the admin account and going thought the UAC much different from using a standard account and needing to select an admin account to get access? I guess that is where I am getting tripped up. I’m still needing to grant permission before anything can happen.

Also – the small program I downloaded may not have been the best example – I chose one from the OlderGeeks Freeware column here at AW, and it seems to be a run on demand type of program, not actually installed. So that may not have given me info on downloads as I’d hoped.

In any case – it seems that everything works in all directions – and I can even change the new standard account to an admin account and back to standard right from the standard account – no need to use an admin account. I just have to grant access and it works.

So – what am I possibly missing? And back to the beginning – would staying logging into my original admin account while doing all of this affect things?

Thanks so much!!

 

Reply | Quote

A – Operating in one account shouldn’t have any inter-dependence with another currently logged-in account. (I can cook, vacuum (rarely!)) whether or not my spouse is in the house.)

B – It is heavy reading, but have you looked at
(Start) > Help and Support > [top right] Options > Browse Help > Security and Privacy > (Categories) Controlling access to your computer ?

C – Your observation that the UAC is the key is correct. That is the Security Police that checks credentials and permits or denies action. In what you are doing, you always have been a good citizen: Mother, may I? Yes.

D – This below is somewhat complex. To pursue it more deeply you may wish to start a new Topic. (Also, in B, above: see Controlling access to your files and folders.)

Not mentioned so far that I recall is the matter of folder and file ‘Ownership’. The active (one who is doing things) user is assigned as the owner of an object that he creates; and this is independent of the (folder) location into-which this thing is placed. When I (as Paul) download a program file (e.g., Firefox Setup) I Save it in a Public Downloads folder. As the Owner, I have unconditional access to it. And, since the folder is Public, anyone can operate with it.

Where one may run into some snags is when an owner is deleted from the system. The ‘things’ that he created then are orphans. Probably usable (it depends), but there may be access conniptions. Another user may be able to Take Ownership – IF …

In all your Admin/Limited users’ gyrations, I recommend that you not delete the original (first logged on ID when Windows was installed) user. Changing between Administrative and Limited is fine, but don’t delete the ID.

2 users thanked author for this post.

LHiggins, doriel

Reply | Quote

PaulK wrote:

I recommend that you not delete the original (first logged on ID when Windows was installed) user.

I don’t like to delete the initial Admin account either and I am going to go farther. Personally I do not like to change a User account back and forth between Admin and Standard. I think I got a Standard account confused / corrupted, ending up adding a new Standard account, moving the files and deleting the old Standard account but that is just me.

1 user thanked author for this post.

LHiggins

Reply | Quote

Good questions. I would reply, that the biggest power of the admin account is it has access everywhere (all folders, all setiings). You do not need to think, if you launched installation with elevated privileges, etc.. Also password is not required, just clik “Yes” when UAC appears 🙂

Dell Latitude 3420, Intel Core i7 @ 2.8 GHz, 16GB RAM, W10 22H2 Enterprise

HAL3000, AMD Athlon 200GE @ 3,4 GHz, 8GB RAM, Fedora 29

PRUSA i3 MK3S+

1 user thanked author for this post.

LHiggins

Reply | Quote

I am dividing programs into 3 groups.

1) programs that you install as Admin and can be used by Standard user.
2) programs that can only be installed and used by Admin user
3) programs that do not install but are simply run

LHiggins wrote:

Also – the small program I downloaded may not have been the best example – I chose one from the OlderGeeks Freeware column here at AW, and it seems to be a run on demand type of program, not actually installed.

This one falls into the third group.

1 user thanked author for this post.

LHiggins

Reply | Quote

I don’t know how this happened, but I have both an Admin and a Local account. Both have the same name (mine), one with the picture I selected and the other with the generic Windows icon.

On startup, the login page appears with this message: > The username or password is incorrect. Try again. When I select OK, the password field appears with the user name above it. Beneath it are two choices: Reset Password and Sign-in Options. I don’t see any help in either one. I type in my password, and login proceeds normally.

When I go to Settings > Accounts > Email & accounts, it says “Set up and manage accounts – To change, delete, etc. Select your account and then select Manage.” But neither account is listed.

Windows 10 Home, v 10.0.18362 Build 18362

Reply | Quote

I suggest to start new topic in the forum. But on the first sight, I saw something similar when I upgraded PC from Win7 to Win10. There were two similar users, one with circular icon. The second one named the same, but his icon was square.. Lets investigate, see you in the new topic.

Dell Latitude 3420, Intel Core i7 @ 2.8 GHz, 16GB RAM, W10 22H2 Enterprise

HAL3000, AMD Athlon 200GE @ 3,4 GHz, 8GB RAM, Fedora 29

PRUSA i3 MK3S+

Reply | Quote