Can permissions on the Local System account be changed?

[[email protected]]

Can permissions on the Local System account be changed or removed etc.
If so, how?

Or are the permissions fixed and cannot be changed?

Thanks.

[Malke]

wrote:

> Can permissions on the Local System account be changed or removed etc.
> If so, how?
>
> Or are the permissions fixed and cannot be changed?
>
> Thanks.

You haven't given us enough information to get a specific answer. Is
this a standalone machine or on a workstation connected to a domain?
What version of XP and what service pack level? Are you the domain
administrator?

Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User

[J Williams]

Malke wrote:
> wrote:
>
> > Can permissions on the Local System account be changed or removed etc.
> > If so, how?
> >
> > Or are the permissions fixed and cannot be changed?
> >
> > Thanks.
>
> You haven't given us enough information to get a specific answer. Is
> this a standalone machine or on a workstation connected to a domain?
> What version of XP and what service pack level? Are you the domain
> administrator?

It's for XP Professional SP2. FWIW I'd like to know the answer in the
case of a standalone m/c and a box connected to a domain (and whether
or not I'm the domain administrator). Thanks for distinguishing those
scenarios.

[Malke]

J Williams wrote:

>
> Malke wrote:
>> wrote:
>>
>> > Can permissions on the Local System account be changed or removed
>> > etc. If so, how?
>> >
>> > Or are the permissions fixed and cannot be changed?
>> >
>> > Thanks.
>>
>> You haven't given us enough information to get a specific answer. Is
>> this a standalone machine or on a workstation connected to a domain?
>> What version of XP and what service pack level? Are you the domain
>> administrator?
>
> It's for XP Professional SP2. FWIW I'd like to know the answer in the
> case of a standalone m/c and a box connected to a domain (and whether
> or not I'm the domain administrator). Thanks for distinguishing those
> scenarios.

Well, of course you can change permissions. If you have a standalone
machine running XP Pro (as you do), you can set very fine-grained
permissions by using the Group Policy Editor.

Start>Run>gpedit.msc [enter]

You need to be logged in with an account with administrative privileges.
If you want to know more about the Group Policy Editor, then type that
into XP's Help & Support. Be careful working with the Group Policy
Editor; it is completely possible to lock yourself out! There is also a
newsgroup for the Group Policy Editor if you have specific questions
about it:

microsoft.public.windows.group_policy

If you have a workstation joined to a domain, permissions are usually
set at the domain level and although there may be a local administrator
for emergencies, normally regular users would not be able to log in as
local administrator or set/change permissions on the domain
workstation. One of the reasons for running a domain is to have central
control of the workstations.

If you want to know more about domain set up and best practices, this is
a vast subject. I suggest starting with TechNet, which is a marvelous
resource:

http://technet.microsoft.com/default.aspx

Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User

[Doug Knox MS-MVP]

As Malke noted, its is entirely possible to lock yourself out of =
critical functions with the Group Policy Editor, on a stand alone =
machine. On a stand alone computer, policies put in place using the =
Group Policy Editor apply to all users of the machine.

You need to provide more information about what you're trying to =
accomplish, or what permissions/capabililties you are trying to =
give/remove from the Local System account.

--=20
Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart =
Display\Security
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
--------------------------------
Per user Group Policy Restrictions for XP Home and XP Pro
http://www.dougknox.com/xp/utils/xp_securityconsole.htm
--------------------------------
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.
=20
"Malke" > wrote in message =
...
>J Williams wrote:
>=20
>>=20
>> Malke wrote:
>>> wrote:
>>>
>>> > Can permissions on the Local System account be changed or removed
>>> > etc. If so, how?
>>> >
>>> > Or are the permissions fixed and cannot be changed?
>>> >
>>> > Thanks.
>>>
>>> You haven't given us enough information to get a specific answer. Is
>>> this a standalone machine or on a workstation connected to a domain?
>>> What version of XP and what service pack level? Are you the domain
>>> administrator?
>>=20
>> It's for XP Professional SP2. FWIW I'd like to know the answer in =
the
>> case of a standalone m/c and a box connected to a domain (and whether
>> or not I'm the domain administrator). Thanks for distinguishing =
those
>> scenarios.
>=20
> Well, of course you can change permissions. If you have a standalone
> machine running XP Pro (as you do), you can set very fine-grained
> permissions by using the Group Policy Editor.
>=20
> Start>Run>gpedit.msc [enter]
>=20
> You need to be logged in with an account with administrative =
privileges.
> If you want to know more about the Group Policy Editor, then type that
> into XP's Help & Support. Be careful working with the Group Policy
> Editor; it is completely possible to lock yourself out! There is also =
a
> newsgroup for the Group Policy Editor if you have specific questions
> about it:
>=20
> microsoft.public.windows.group_policy
>=20
> If you have a workstation joined to a domain, permissions are usually
> set at the domain level and although there may be a local =
administrator
> for emergencies, normally regular users would not be able to log in as
> local administrator or set/change permissions on the domain
> workstation. One of the reasons for running a domain is to have =
central
> control of the workstations.
>=20
> If you want to know more about domain set up and best practices, this =
is
> a vast subject. I suggest starting with TechNet, which is a marvelous
> resource:
>=20
> http://technet.microsoft.com/default.aspx
>=20
> Malke
> --=20
> Elephant Boy Computers
> www.elephantboycomputers.com
> "Don't Panic!"
> MS-MVP Windows - Shell/User