non-deletable accounts in XP (SP2)

[emilvarona@gmail.com]

Hi,
Does anyone know if it is possible to create a non-deletable user
account in XPSP2? I support a team of users that have admin rights
(developers). Occasionally, they lock themselves out and have already
changed the local Administrator p/w. I'd like to create a new user
account that they cannot delete (similar to the built-in admin account)
so I can still access their machine. If they change THAT p/w, I have
an out but they'll prob first del the acct.

I'd prefer to do it in VB (VB6, .NET, VBS - I don't really care) so I
can automate deployment from AD GPO, but I can't see how to make the
account non-deleting without lowering them to 'power user'. (BTW, I've
already been told by the bosses that lowering rights is not
acceptable.)

Any thoughts?

[Justin Haygood]

If you use a domain, use the admin account on that. But, if its XP Pro,
there is a Developers group that has more rights than Developers but
slightly less rights than Administrators.

> wrote in message
ups.com...
> Hi,
> Does anyone know if it is possible to create a non-deletable user
> account in XPSP2? I support a team of users that have admin rights
> (developers). Occasionally, they lock themselves out and have already
> changed the local Administrator p/w. I'd like to create a new user
> account that they cannot delete (similar to the built-in admin account)
> so I can still access their machine. If they change THAT p/w, I have
> an out but they'll prob first del the acct.
>
> I'd prefer to do it in VB (VB6, .NET, VBS - I don't really care) so I
> can automate deployment from AD GPO, but I can't see how to make the
> account non-deleting without lowering them to 'power user'. (BTW, I've
> already been told by the bosses that lowering rights is not
> acceptable.)
>
> Any thoughts?
>

[emilvarona@gmail.com]

> But, if its XP Pro,
> there is a Developers group that has more rights
> than Developers but slightly less rights than Administrators.

Two problems with this. There still needs to be a local account that
is a member of the group. The problem is that 'somehow', the machines
are disjoined from AD and only a local logon will work. The ID must
have local admin rights so that I can rejoin to AD.

Second, I've never seen a built-in group called "Developers"... Did I
miss something? Thanks.