Windows 8.1 User accounts

On Wed, 17 Sep 2014 20:50:04 +0100, Joe User wrote:

On 17/09/14 20:40, Gene E. Bloch wrote:
On Wed, 17 Sep 2014 20:11:59 +0100, Joe User wrote:

The real question is and the one that is keeping me busy at the moment
is trying to figure out what the differences are between the
Administrator account I created on install and the one that was created
by the net user command. There certainly is a difference (in the desktop
at least) and I cannot run IE in the net user account, even though the
app is on the desktop whereas I can in JoeUser who is also an
Administrator apparently.

Finally the question (phew)
What is/are the differences between the *net user* created Administrator
account and the Administrator account created during install?

1. The Administrator account (the real one) has always existed. You
didn't create it, you just enabled access to it.

Later, when you are finished your work, you should run

net user Administrator /active:no

That turns off access to the Administrator, it doesn't remove it. And
it's safer with that disabled, preventing some malware from doing mal.

2. The other account, the one created on installation, and your usual
account (well, it's *my* usual account) is not *the* Administrator
account. It's a regular user account with some, but not all,
Administrator privileges.

Microsoft is good at creating confusing names for things... There are
really three types of accounts, named by MS as follows:

The Administrator
This is the *real* Administrator that has a maximal set of capabilities

Administrator accounts
This is actually a normal user account with some Administrator
privileges

Standard user
This is a user account with *no* Administrator privileges

One other account is Guest, which is built-in. I'm not sure whether its
privileges are the same as a Standard user account or reduced from that,
since mine is listed as "off", and doesn't show its privilege level.

OK, I understand, thanks. Now to do some playing around and see how easy
it is to break things.

Too easy! :-)

I got a kick out of that...

--
Gene E. Bloch (Stumbling Bloch)

On 17/09/14 22:41, Gene E. Bloch wrote:
On Wed, 17 Sep 2014 20:46:17 +0100, Joe User wrote:

On 17/09/14 20:25, Gene E. Bloch wrote:
On Wed, 17 Sep 2014 20:11:59 +0100, Joe User wrote:

I then log out

When I try to log in again I now have two accounts. the original,
JoeUser and a new one, Administrator. I log into this new account

A slightly easier way is to select Switch User to get there. You can
leave the other user logged in for later.

You should still log the Administrator out when you've finished what
you're doing, which is safer than leaving it running when you switch
back to the regular user.

OK thanks, when I try alt+f4 switch user, both my users are shown as
logged in but both still require a password ... which is a little ...
confusing, or should that be bewildering :-)

When switching, you need a password to get to a user. That's even true
for me, where my usual user doesn't require a password for booting (it
has a password, but I set it up to bypass that on booting). It's a
security feature...

snip

OK, that's all good advice.

I will rest easier knowing that :-)

I don't let any of my lot anywhere near any of my machines
My Wife has a Win7 box for work and I have an old XP machine that I let
the kids use when they visit.

Apart from that all my Linux boxes and my various Android devices are
locked down ... *that's* when I rest easy :-)

Anyway, with judicious use of virtualbox snapshots I have no got to the
state where I can reset the vm to a single, no password, Joe User
'Administrator' account when I bugger things up ... and it way too easy
to bugger things up.

Example:
* Single create on install Joe User admin ac no pwd
* log in to Joe User the WinKey + x, choose Command Prompt(admin)
* net user "Joe User" /active:no
* log out

WTF!!!, now I'm locked out.

Where is the logic in this?
Why does this make sense?

JU
--
Not confused, just ... bewildered

On Thu, 18 Sep 2014 11:06:53 +0100, Joe User wrote:

On 17/09/14 22:41, Gene E. Bloch wrote:
On Wed, 17 Sep 2014 20:46:17 +0100, Joe User wrote:

On 17/09/14 20:25, Gene E. Bloch wrote:
On Wed, 17 Sep 2014 20:11:59 +0100, Joe User wrote:

I then log out

When I try to log in again I now have two accounts. the original,
JoeUser and a new one, Administrator. I log into this new account

A slightly easier way is to select Switch User to get there. You can
leave the other user logged in for later.

You should still log the Administrator out when you've finished what
you're doing, which is safer than leaving it running when you switch
back to the regular user.

OK thanks, when I try alt+f4 switch user, both my users are shown as
logged in but both still require a password ... which is a little ...
confusing, or should that be bewildering :-)

When switching, you need a password to get to a user. That's even true
for me, where my usual user doesn't require a password for booting (it
has a password, but I set it up to bypass that on booting). It's a
security feature...

snip

OK, that's all good advice.

I will rest easier knowing that :-)

I don't let any of my lot anywhere near any of my machines
My Wife has a Win7 box for work and I have an old XP machine that I let
the kids use when they visit.

Apart from that all my Linux boxes and my various Android devices are
locked down ... *that's* when I rest easy :-)

Anyway, with judicious use of virtualbox snapshots I have no got to the
state where I can reset the vm to a single, no password, Joe User
'Administrator' account when I bugger things up ... and it way too easy
to bugger things up.

Example:
* Single create on install Joe User admin ac no pwd
* log in to Joe User the WinKey + x, choose Command Prompt(admin)
* net user "Joe User" /active:no
* log out

WTF!!!, now I'm locked out.

Where is the logic in this?
Why does this make sense?

It's obvious: you're being punished for experimenting with Redmond's
best planned OS :-)

You could also log into an elevated command prompt and delete
everything, or you could boot from a Linux CD and format your hard
drive.

A popular hardware trick some have tried is to drive around the railroad
crossing gate, knowing you can beat the train. One or two people have
survived that trick.

The only one to blame for these things is...Oh let me think, I just
can't figure that out...

--
Gene E. Bloch (Stumbling Bloch)

On 18/09/14 18:08, Gene E. Bloch wrote:
On Thu, 18 Sep 2014 11:06:53 +0100, Joe User wrote:

On 17/09/14 22:41, Gene E. Bloch wrote:
On Wed, 17 Sep 2014 20:46:17 +0100, Joe User wrote:

On 17/09/14 20:25, Gene E. Bloch wrote:
On Wed, 17 Sep 2014 20:11:59 +0100, Joe User wrote:


snip


Anyway, with judicious use of virtualbox snapshots I have no got to the
state where I can reset the vm to a single, no password, Joe User
'Administrator' account when I bugger things up ... and it way too easy
to bugger things up.

Example:
* Single create on install Joe User admin ac no pwd
* log in to Joe User the WinKey + x, choose Command Prompt(admin)
* net user "Joe User" /active:no
* log out

WTF!!!, now I'm locked out.

Where is the logic in this?
Why does this make sense?

It's obvious: you're being punished for experimenting with Redmond's
best planned OS :-)

You could also log into an elevated command prompt and delete
everything, or you could boot from a Linux CD and format your hard
drive.

Believe me, if it was up to me I have one box running Ubuntu for the
beginners, one running Mageia for the more adventurous, one running
CentOS for the wannabe admins and one running Slackware for the nutters
but as it is I'm stuck with this nonsense.

A popular hardware trick some have tried is to drive around the railroad
crossing gate, knowing you can beat the train. One or two people have
survived that trick.

The only one to blame for these things is...Oh let me think, I just
can't figure that out...

It *has* to be my fault ... doesn't it?

Now I just gotta explain all this to my fellow helpers.

Thanks for taking the time, it's been most helpful.


--
Not confused, just ... bewildered

On Thu, 18 Sep 2014 19:46:51 +0100, Joe User wrote:

The only one to blame for these things is...Oh let me think, I just
can't figure that out...

It *has* to be my fault ... doesn't it?

You got it!

I have to say, it's fun assigning blame - especially to people like you
who won't take it seriously.

In conversation, I have a similar problem to Usenet, where my poker face
is too good (I apparently don't realize I'm doing it).

--
Gene E. Bloch (Stumbling Bloch)

On 18/09/14 22:14, DK wrote:
In article , Joe User wrote:
On 13/09/14 18:19, Joe User wrote:
Good afternoon

I am helping out at a local charity drop in center
I have 4 * 6 month old Windows 8.1 machines and I'm trying to understand
the whole user account thing. I'm actually more used to managing *nix
accounts so this is proving a little 'challenging' to say the least.

snip

Thanks to all the responders so far I think I have figured out what is
supposed to happen when you do a fresh install.
This is just a sanity check really, any advice most welcome.

When I do a fresh install (win 8.1) I create an account, I do not supply
a password. When everything is installed I do WinKey + x and select
Command Prompt(Admin).

At the command prompt I type

net user Administrator /active:yes

Great - you figured out the most retarded feature of Win 8.*:
an account with admin privileges does not have full control of the system.
it takes an account hard-wired to be calles "Administrator" to have a
semblance of the root in Unix.

Well actually it's kind of making sense now

When you install (say) Ubuntu you create an account during installation,
this account is in sudoers.
You log in as your user and issue sudo passwd root
you set the root password then you can login to the root account and
disable the ability of sudoers to change the root password (I forget how
to do this OTTOMH).

In 8.1 you create your (effectively) sudoers account during install, log
in and enable the Administrator 'SuperUser' account. You can then set
the password for the Administrator. So far so good, now what I want to
do is to disable the ability of the (sudoers) account(s) to change the
superusers password.

Can't figure that out at the moment, sigh, keep digging around in the
guts of win8 ...

Joe

--
Not confused, just ... bewildered

On Fri, 19 Sep 2014 10:48:26 +0100, Joe User wrote:

On 18/09/14 22:14, DK wrote:
In article , Joe User wrote:
On 13/09/14 18:19, Joe User wrote:
Good afternoon

I am helping out at a local charity drop in center
I have 4 * 6 month old Windows 8.1 machines and I'm trying to understand
the whole user account thing. I'm actually more used to managing *nix
accounts so this is proving a little 'challenging' to say the least.

snip

Thanks to all the responders so far I think I have figured out what is
supposed to happen when you do a fresh install.
This is just a sanity check really, any advice most welcome.

When I do a fresh install (win 8.1) I create an account, I do not supply
a password. When everything is installed I do WinKey + x and select
Command Prompt(Admin).

At the command prompt I type

net user Administrator /active:yes

Great - you figured out the most retarded feature of Win 8.*:
an account with admin privileges does not have full control of the system.
it takes an account hard-wired to be calles "Administrator" to have a
semblance of the root in Unix.

Well actually it's kind of making sense now

When you install (say) Ubuntu you create an account during installation,
this account is in sudoers.
You log in as your user and issue sudo passwd root
you set the root password then you can login to the root account and
disable the ability of sudoers to change the root password (I forget how
to do this OTTOMH).

In 8.1 you create your (effectively) sudoers account during install, log
in and enable the Administrator 'SuperUser' account. You can then set
the password for the Administrator. So far so good, now what I want to
do is to disable the ability of the (sudoers) account(s) to change the
superusers password.

Can't figure that out at the moment, sigh, keep digging around in the
guts of win8 ...

Joe

I'm rather sure that you can't change the 'root' password unless you
know the existing one.

Naturally, in the normal course of affairs the person who created the
Administrator level account would also be the person who created The
Administrator's password.

Nonetheless, if you walk away from your computer leaving it logged into
your Admin-level account, and while you're away, I try to change the
Administrator password, I'd be SOL without knowing the current PW.

I don't want to experiment to verify my first remark, because I don't
want to mess up :-)

Aside to DK: this dichotomy between the two kinds of Administrator
accounts predates W8 by a long shot, and IMO there are sound security
reasons for it. In fact, it's a bit like what Joe User described above
for sudoers passwords, albeit with less user choice.

--
Gene E. Bloch (Stumbling Bloch)

On 19/09/14 18:38, Gene E. Bloch wrote:
On Fri, 19 Sep 2014 10:48:26 +0100, Joe User wrote:

On 18/09/14 22:14, DK wrote:
In article , Joe User wrote:
On 13/09/14 18:19, Joe User wrote:
Good afternoon

snip

Nonetheless, if you walk away from your computer leaving it logged into
your Admin-level account, and while you're away, I try to change the
Administrator password, I'd be SOL without knowing the current PW.

Not at all, as an Administrator you can change any other Administrator
password. even the 'default', no password, create on install,
'Administrator' can change the net user Administrator /active:yes
hidden, default, hardcoded or whatever the **** they call it account
password without knowing the original ... and there doesn't seem to be a
way to prevent it. I know this because I have tested it repeatedly using
a virtualbox snapshot so I don't have to keep re-installing. I have also
tested on one of the 'real' Windozy boxes.

I asked a question on a MS 'support' forum and was told that an Admin is
an Admin is an Admin so I asked what the point of the hidden
Administrator account was if anyone (any admin for the pedantic out
there) can enable/disable change the password of and generally mess
about with this mystical seemingly pointless account and have so far
been met with a deafening silence.


I don't want to experiment to verify my first remark, because I don't
want to mess up :-)

Install a Virtual Machine manager.

Aside to DK: this dichotomy between the two kinds of Administrator
accounts predates W8 by a long shot, and IMO there are sound security
reasons for it. In fact, it's a bit like what Joe User described above
for sudoers passwords, albeit with less user choice.

But there is no difference that I can see or find out about. The sudoers
thing is a red herring I mistakenly introduced, it's nothing like sudo,
with sudo you can restrict what the sudoer can do. With Windows 8.1
admin user accounts apparently you can't. I can't believe this is
actually the case so will continue to look into it ... I'm getting a bit
of a sinking feeling that I might be wasting my time though.

And to think people actually *pay money* for this nonsense.


--
Not confused, just ... bewildered

On Fri, 19 Sep 2014 19:57:11 +0100, Joe User wrote:

And to think people actually *pay money* for this nonsense.

Switch to Linux, you'll no doubt be happier.

I have a VM running XP, but I don't wont to bother running that ATM, so
I'll just do the experiment here, since I really won't screw up.

--
Gene E. Bloch (Stumbling Bloch)

On Fri, 19 Sep 2014 12:08:50 -0700, Gene E. Bloch wrote:

On Fri, 19 Sep 2014 19:57:11 +0100, Joe User wrote:

And to think people actually *pay money* for this nonsense.

Switch to Linux, you'll no doubt be happier.

I have a VM running XP, but I don't wont to bother running that ATM, so
I'll just do the experiment here, since I really won't screw up.

I tried to change my own account's PW, since Administrator is currently
not enabled. The first box in the change PW dialog asks for my current
password.

The other available accounts are all standard users; they don't require
me (an Administrator) to know their passwords.

After lunch I'll enable the Admin and switch user for an additional
experiment.

--
Gene E. Bloch (Stumbling Bloch)

On 19/09/14 20:08, Gene E. Bloch wrote:
On Fri, 19 Sep 2014 19:57:11 +0100, Joe User wrote:

And to think people actually *pay money* for this nonsense.

Switch to Linux, you'll no doubt be happier.

I have a VM running XP, but I don't wont to bother running that ATM, so
I'll just do the experiment here, since I really won't screw up.

Check the headers, I only run Linux.

But the charity doesn't and I need to lock those machines down.

--
Not confused, just ... bewildered

On Fri, 19 Sep 2014 20:19:01 +0100, Joe User wrote:

On 19/09/14 20:08, Gene E. Bloch wrote:
On Fri, 19 Sep 2014 19:57:11 +0100, Joe User wrote:

And to think people actually *pay money* for this nonsense.

Switch to Linux, you'll no doubt be happier.

I have a VM running XP, but I don't wont to bother running that ATM, so
I'll just do the experiment here, since I really won't screw up.

Check the headers, I only run Linux.

But the charity doesn't and I need to lock those machines down.

1. You are right - my user account can change the Administrator password
w/o knowledge of the current password.

Now I believe you! As you always did :-)

Time to grovel: I was wrong.

2. It turns out to be a good thing for me today. The Administrator
account would not accept the password I had given it. Now it does.

The old password was one that I remember, but I also rechecked it in my
password file. If I had changed it, I didn't record the fact...

3. My neighbor lost his password recently. I was able to create a new
one without booting to his Windows. There are a few recipes online for
doing this...

4. Given statement 1 & 3 above, you are right to worry...

5. And I can't help. And I bet you find that statement believable :-)

6. Thanks for forcing me to learn something (no sarcasm; I'm glad to
learn).

--
Gene E. Bloch (Stumbling Bloch)

Gene E. Bloch wrote:

1. You are right - my user account can change the Administrator password
w/o knowledge of the current password.

Was that user account was a standard user account ?

--
...winston
msft mvp consumer apps

On Sat, 20 Sep 2014 02:38:20 -0400, . . .winston wrote:

Gene E. Bloch wrote:

1. You are right - my user account can change the Administrator password
w/o knowledge of the current password.

Was that user account was a standard user account ?

No, it was an admin account. I didn't even bother with testing a
standard account.

--
Gene E. Bloch (Stumbling Bloch)

Gene E. Bloch wrote:
On Sat, 20 Sep 2014 02:38:20 -0400, . . .winston wrote:

Gene E. Bloch wrote:

1. You are right - my user account can change the Administrator password
w/o knowledge of the current password.

Was that user account was a standard user account ?

No, it was an admin account. I didn't even bother with testing a
standard account.


Which then raises the question...if one wishes to keep other user's from
changing things on a system, why not password protect the Admin account
and create standard users accounts for the others.

--
...winston
msft mvp consumer apps