|
Patch reliability is unclear. Unless you have an immediate, pressing need to install a specific patch, don't do it. |
With EOL for Windows 7 rapidly approaching I’d like to take a step I should’ve taken years ago, creating a Standard User Account.
I know the basics of how to make a new user account but I would like to make sure there aren’t any extra steps I need to take.
Once the account is created I know I’ll need to add my programs into it and I can’t really find an explanation of how to do that. Will I have to reinstall everything or is there another way?
Not sure but I think you need to create a password for one or both accounts. When I was working, the company I worked for required us all to have user accounts but I also had an administrator account in Win XP at that time. Both had their own password.
I could see all the programs from both accounts on the setup I had then and I was connected to the company’s network. I do know that the User account was added after the Admin. account. I didn’t set it up, the company administrator did.
I’m thinking about making a user account too so I’m interested in knowing all the particulars too.
Before doing what @jabeattyauditor mentioned just above this post, please make sure you’re logged into your OLD account you want to migrate the files and data FROM. Once you’ve followed his instructions, simply click the button that says “Move…” below the box that shows their current location. That will allow you to move all of your EXISTING files/folders to the new location. I believe that clicking the button that says “Find Target…” will allow you to change where all files created from now on will go, however.
Create an admin account – it will be a new account, not the one you have been using. Now try to log in on the new account. Make sure that you have full admin access with the new account. Once you are sure, write down the password to the new account.
Now log in to your regular account. Go to Control Panel / User Accounts, and change your regular account to a “Standard” account.
Important: Make sure your new admin account works and has full admin access before changing your regular account to a standard account!
The idea is, create a second account which is an admin account; then change your normal account to a standard account. In this way, you can continue to use your normal account, and everything will be there just as it has always been. You just won’t have full admin rights with that account. But you do need to have a way to have full admin rights, and that’s why you will create a new account with full admin rights, for those occasions when full admin rights are needed.
No need to “migrate” anything if you do it this way. And if you need to install something, you can always log in on the new account, give your normal account admin rights, then do the install while logged in to your normal account. (Sometimes this is necessary.) Then change your normal account back to a standard account after doing the install.
Trust me, I’ve been doing this for decades. This is the easiest way to start using a non-admin account from this point forward.
This is the best way of doing what you are trying to accomplish. No fuss and all of your customizations stay.
Never Say Never
I had already started moving me files and folders by the time I saw your post, but I’m going to print your post so when I do this the next time I’ll have an easier time.
Not sure what you mean by full access. If you are attempting to set it up as @mrjimphelps described, check in accounts to see if the new user is part of the administrators group. You can also check in command line by using net user “username”
Never Say Never
Basically, you log in on the new account (make sure you can do that), and then go to Control Panel / User Accounts and see if the new account is listed as “Administrator”.
As a final test, while logged in on the new account, try to open a folder in the other user’s Documents folder. If you are an administrator, it will tell you that you need permission to do that, and it will allow you to give yourself that permission. If it doesn’t allow you to give yourself that permission, then you are not an administrator.
I would tell it to give you the permission. And I would then actually go to the folder in question to make sure that you actually do have access to it. In that way you can verify that the account is, in fact, an administrator account.
It is absolutely essential that you have a working administrator account that you can use if needed. That’s why I recommend that you double and triple check to make sure that the new account is in fact an administrator account. Because once you relinquish administrator rights on your normal account, it will be impossible to get them back if you don’t have another account which is an administrator account.
You did it right, as long as you were not trying to open the new account’s user folder, because the new account should already have permission to open its own user folder. But the fact that it told you that you didn’t have permission tells me that you were trying to open a good test folder.
User folders are found here:
C:\users\<username>
In all cases, it will tell you that you don’t have permission to open someone else’s user folder. If you are an administrator, it will allow you to give yourself permission. If you are not an administrator, it will prompt you for the password of an administrator account.
As long as you know that you have a working admin account, and you know its password, you are ready to change your normal account to standard.
It is very simple to change an admin acct to standard – go to Control Panel / User Accounts, and change it to Standard. And you can be logged in to that account when you do it, because you are an administrator at the time of the change, and you can therefore change the rights on your own account. However, if you ever want to restore admin rights to that account, you will need to be logged in as an administrator to do so, that is, you can’t increase your own rights when you are currently a standard user.
Protect Your Computer with This One Simple Trick
https://www.tomsguide.com/us/limited-account-benefits,news-25682.html
skip to the section titled:
How limited accounts protect you
So you do get security advantages from using a Standard User Account in Windows 10 as of Spring, 2019 (Version 1903).
-- rc primak
Chrome will be updatable from the standard account. LibreOffice probably will be updatable in the same manner.
However, to properly use Windows Update, you will need to log into Windows using an account with administrator privileges.
R/
Bob99
Windows Update is a global updating service, meaning that all users are updated at the same time. Windows Defender also updates globally.
The Microsoft Store Apps are not globally updated, though they can be synced if you have this set up in your Microsoft Account. I would run the Store App and updates in both accounts after setting up any new account. Windows Timeline if you use it is also run and cleared per account.
The Google Chrome Browser can be installed “for all users” and will update everyone at once. But it can also be installed per-user and would need per-user updating. Don’t forget to run the Component Updating for Flash Player if you’re using it, and update any Extensions per user. Firefox last I used it on Windows was updated per user.
CCleaner Free Edition runs non-globally, so it has to be run per-user. Glary Utilities runs globally, and is best run from an Administrator Account. Antivirus updates and scans are also global. (Antivirus system scans are best done from an Administrator Account, though you can in many cases run a Quick Scan from a Standard User Account.)
LibreOffice installs and updates globally by default, but it can also be installed per user. If it’s installed globally, when you create a new account but are not installing a LO update, you will need to manually create desktop shortcuts for each user, for each LO component for which you want to have shortcuts. You need to find these Executables in your Programs Folder under LibreOffice.
Third party software may update globally or per-user. Check each user to make sure everything has updated properly. Some third party programs also make you create new desktop shortcuts for new users. That can be a pain, as you have to find the Main Executable for each program and Send To Desktop. And Portable Apps will need to be copied to each new account. They generally do not need fresh downloads, but may need to configure themselves from the beginning on each new account to which they are copied.
Settings generally are per-account as well, especially appearance settings. This applies to the Windows Settings as well as any Application Settings.
Otherwise, creating the new account and getting it up and running should be easy. And highly recommended, so that you can use a Standard User Account for everyday tasks, but an Administrator Account for maintenance and updating tasks, which require Admin. privileges.
-- rc primak
.
.
I view it as one more layer to keeping my Windows 7 running for as long a possible.
I like knowing that running a standard account makes it just that little bit harder for things I don’t want to get into my system.
Windows 7 going EOL soon just reminded me that I had thought about doing this before but never actually got around to it.
Moonbear is exactly right – using a standard account makes it harder for bad things to happen on your computer. For example, if you are using a standard (i.e. a non-admin) account, and a program tries to install itself on your computer, you will be prompted for an admin password; the program won’t be able to install itself without that password.
Using a standard account is not an absolute guarantee that nothing bad will happen; but it makes it a lot harder for bad things to happen.
The reason everything looks different is because a new user account (either Admin or Standard) operates without any of the changes or customizations that have been made to the visual settings and the like.
If you create a new Admin account and then set the account you use everyday as a Standard account you won’t need to worry about making the new admin account look right because you’ll only be logging into it when you need to set the Standard account back to Admin long enough to install or update software if/when certain things won’t update from the Standard account. After that’s done you’d reset the account back to Standard and be on your way.
So simple…
Trying to make it difficult… duh.
Happy new decade and thanks for letting me hijack your thread!
Retired Rocket Scientist
“UpdatusUser” folder is automatically created by NVIDIA graphics card driver installer.
Never Say Never
It is about prevention vs disaster recovery. A good carpenter can rebuild a house, but someone who stops it from burning down in the first place is ahead of the game. If you create frequent and multiple backup images, you can restore if you install a virus or ransomware. That is you can restore – but only after you notice that you are infected, only if you have kept a backup that existed before the ransomware, and the virus may have already harvested your passwords. If you always run as a standard user instead of an admin, this will prevent the majority of viruses from installing, and if you are careful when you see a “admin permission required” popup and don’t just always agree you will prevent even more viruses.
If your regular account is an administrator account, then you can convert it to a standard account while logged in on that account. The fact that it is an administrator account when you make the change allows you to do this while logged in on that account.
However, the opposite is not true. If your regular account is a standard account, you cannot convert it to an administrator account while logged in on that account, because a standard account cannot change any account to an administrator account.
Think of it this way: If I have a copy of my car key, I can throw that key away; but once I have thrown it away, I no longer have access to my car; and I have no way of getting the key back on my own, I have to go to someone else who has a copy of my car key and ask them to make me a copy of the key. Once they do that, I now have a copy of the key, and I once again have access to my car.
For this reason, you MUST make sure that there is always a working administrator account on your computer, one that you can access anytime you need to.
Another reason for having a separate admin account that you use only when you need to:
Whenever you use your account, it is possible for the files in your account to get corrupted and your account to become inaccessible as a result. If you are constantly logged in on your administrator account, you increase the chance that it will become corrupted and therefore inaccessible. But if you hardly ever log in on your admin account, you greatly decrease the chance that it will become corrupted and therefore inaccessible. In other words, you will always have a way that you can get in and fix things should something go wrong.
Let me clarify:
Often, you can install a program while logged in as a “standard user”. However, sometimes you need to be an administrator. It is those times (when you must be an administrator) that I was talking about.
In those times when you need to be an administrator, when you start the install, it will usually prompt you for an administrator’s username and password. You can then proceed with the install, logged in as a standard user, because Windows will use the administrator rights you were prompted for to do the install. This is the way it almost always happens.
However, there are rare occasions when the account which will use a program needs to be the one which installs the program, and that same account needs administrator rights in order to install the program. For those rare occasions, you will need to log out as the standard user, log in as the administrator, and then give administrator rights to the account you use for daily work. You then log in on that account and do the install, and then revert the daily account back to a standard account. These situations are rare, but I have seen them over the years.
There have been a handful of times when I have had to do that. And it has been a long time since I last had to do it. I can tell you the company I worked for when that happened, but I can’t tell you the programs involved. I can say that we were running Windows 2000 at the time, and that XP was out but we simply hadn’t yet switched to it.
My guess is that you will probably never have to convert your daily account to an admin account temporarily so as to complete an install, then convert it back to a standard user account. But should you ever find that giving the admin username and password when doing an install isn’t sufficient, you will know a trick that will work to get the install done.
Converting my daily account to an admin account would be my last resort, but I would keep it in my bag of tricks in case I ever needed it.
You should always be able to install them as a standard user (i.e. while logged in on your daily account). If you find that you can’t, then look for a setting in Control Panel / Windows Updates which will allow all users to install updates.
You can install most anything from within your standard account. A dialogue will pop up asking for admin credentials. Enter your admin user and pass and it will install.
Why keep switching your standard account back to admin and back again? If you need admin access for maintenance or whatever log into your admin account do the system maintenance and when finished log out and back to your regular standard account.
Never Say Never
I do not go back and forth, with the standard user account. The standard user account is used for web surfing, get email, everyday computer usage.
I log in as the admin account, to perform Windows Updates and software updates. (Some exceptions are Chrome and some anti-virus which allow the standard user to update.)
I keep a second admin account, in case I get locked out of the primary admin account (it happen once.)
What you are doing is good and gives you a better chance at keeping malware off, as noted in this forum, but not full-proof [it is very hard to be full-proof].
I log in as the admin account, to perform Windows Updates and software updates. (Some exceptions are Chrome and some anti-virus which allow the standard user to update.)
Hm, I thought you shouldn’t actually need to do desktop login as admin even so? Because on W10 Pro 1909 I can manage to do pretty much everything with just the run-as-admin functionality and the separate admin account’s credentials…
Actually I’ve been in organizations where IT personnel’s usual separate admin accounts were outright blocked from desktop login.
It depends on what type of admin tasks you are trying to do. On a few occasions, there are strings of tasks or commands which I need to run one after the other to complete a task. Then it makes more sense to run the whole session as Administrator. Otherwise I agree, UACs are sufficient for most tasks.
-- rc primak
… exactly.
Though I did remember, there is one task… Windows Media Creation Tool wants to be run with admin-level desktop login.
No, I really can’t figure out a good reason for that.
Can just as well use a non-Microsoft operating system (or user-agent spoofer) and just download a straight .iso for most cases…
Others exist too but they’re sort of rare, and usually cases where a programmer really should know better.
If I open the Properties and click the Security tab of any of the programs that are now on the public desktop, I see this in the list of Groups or user names:
Account Unknown(S-1-5-21-804280639-3918793362-3679567503-1003)
in the Advanced window it is shown as type allow with special permission inherited from
C:Users\Public\Desktop\
Also on the Groups and user name tab the permission check-marks are grey not black
If I delete the program shortcut from the Public Desktop folder and recreate it on the Standard account desktop, Account Unknown isn’t listed in the Groups or user names anymore.
Is this something I should worry about?
Make an image backup to external disk before making any more changes.
When your PC finally dies you will need a new OS on the replacement. Windows 10 or Chrome are the probable choices and neither is good with data collection – Chrome possibly being worse.
cheers, Paul
I’m too old to learn Linux and I’ll never go to W10.
I am not a believer of this. If you take your time, and learn slowly, you can get there; whichever OS you choose next. Now might be a good time, while the other PC’s are OK and you can slowly migrate over to a new computer.
Yes, it is normal, since you are changing system level settings. A Standard User usually doesn’t have permission to change system settings.
When I connect my external HD to create a system image, my standard user account can get to the files and previous system images but it can’t open them. It’s my opinion, and as @pkcano said above, system changes are what prompt a sign in with admin password. It isn’t until you reach that level of change for the Admin to kick in.
MacOS, iOS, iPadOS, and SOS at times.
Now that I know how this works it makes perfect sense, I’m just used to how this worked when I was using the Admin account full time.
When I would open the task scheduler (or anything else important) it would always ask if I wanted to let it make changes and I expected it to be the same with the Standard account.
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
