If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below. |
|
|
Thread Tools | Rate Thread | Display Modes |
#16
|
|||
|
|||
Windows 8.1 User accounts
On Wed, 17 Sep 2014 20:50:04 +0100, Joe User wrote:
On 17/09/14 20:40, Gene E. Bloch wrote: On Wed, 17 Sep 2014 20:11:59 +0100, Joe User wrote: The real question is and the one that is keeping me busy at the moment is trying to figure out what the differences are between the Administrator account I created on install and the one that was created by the net user command. There certainly is a difference (in the desktop at least) and I cannot run IE in the net user account, even though the app is on the desktop whereas I can in JoeUser who is also an Administrator apparently. Finally the question (phew) What is/are the differences between the *net user* created Administrator account and the Administrator account created during install? 1. The Administrator account (the real one) has always existed. You didn't create it, you just enabled access to it. Later, when you are finished your work, you should run net user Administrator /active:no That turns off access to the Administrator, it doesn't remove it. And it's safer with that disabled, preventing some malware from doing mal. 2. The other account, the one created on installation, and your usual account (well, it's *my* usual account) is not *the* Administrator account. It's a regular user account with some, but not all, Administrator privileges. Microsoft is good at creating confusing names for things... There are really three types of accounts, named by MS as follows: The Administrator This is the *real* Administrator that has a maximal set of capabilities Administrator accounts This is actually a normal user account with some Administrator privileges Standard user This is a user account with *no* Administrator privileges One other account is Guest, which is built-in. I'm not sure whether its privileges are the same as a Standard user account or reduced from that, since mine is listed as "off", and doesn't show its privilege level. OK, I understand, thanks. Now to do some playing around and see how easy it is to break things. Too easy! :-) I got a kick out of that... -- Gene E. Bloch (Stumbling Bloch) |
Ads |
#17
|
|||
|
|||
Windows 8.1 User accounts
On 17/09/14 22:41, Gene E. Bloch wrote:
On Wed, 17 Sep 2014 20:46:17 +0100, Joe User wrote: On 17/09/14 20:25, Gene E. Bloch wrote: On Wed, 17 Sep 2014 20:11:59 +0100, Joe User wrote: I then log out When I try to log in again I now have two accounts. the original, JoeUser and a new one, Administrator. I log into this new account A slightly easier way is to select Switch User to get there. You can leave the other user logged in for later. You should still log the Administrator out when you've finished what you're doing, which is safer than leaving it running when you switch back to the regular user. OK thanks, when I try alt+f4 switch user, both my users are shown as logged in but both still require a password ... which is a little ... confusing, or should that be bewildering :-) When switching, you need a password to get to a user. That's even true for me, where my usual user doesn't require a password for booting (it has a password, but I set it up to bypass that on booting). It's a security feature... snip OK, that's all good advice. I will rest easier knowing that :-) I don't let any of my lot anywhere near any of my machines My Wife has a Win7 box for work and I have an old XP machine that I let the kids use when they visit. Apart from that all my Linux boxes and my various Android devices are locked down ... *that's* when I rest easy :-) Anyway, with judicious use of virtualbox snapshots I have no got to the state where I can reset the vm to a single, no password, Joe User 'Administrator' account when I bugger things up ... and it way too easy to bugger things up. Example: * Single create on install Joe User admin ac no pwd * log in to Joe User the WinKey + x, choose Command Prompt(admin) * net user "Joe User" /active:no * log out WTF!!!, now I'm locked out. Where is the logic in this? Why does this make sense? JU -- Not confused, just ... bewildered |
#18
|
|||
|
|||
Windows 8.1 User accounts
On Thu, 18 Sep 2014 11:06:53 +0100, Joe User wrote:
On 17/09/14 22:41, Gene E. Bloch wrote: On Wed, 17 Sep 2014 20:46:17 +0100, Joe User wrote: On 17/09/14 20:25, Gene E. Bloch wrote: On Wed, 17 Sep 2014 20:11:59 +0100, Joe User wrote: I then log out When I try to log in again I now have two accounts. the original, JoeUser and a new one, Administrator. I log into this new account A slightly easier way is to select Switch User to get there. You can leave the other user logged in for later. You should still log the Administrator out when you've finished what you're doing, which is safer than leaving it running when you switch back to the regular user. OK thanks, when I try alt+f4 switch user, both my users are shown as logged in but both still require a password ... which is a little ... confusing, or should that be bewildering :-) When switching, you need a password to get to a user. That's even true for me, where my usual user doesn't require a password for booting (it has a password, but I set it up to bypass that on booting). It's a security feature... snip OK, that's all good advice. I will rest easier knowing that :-) I don't let any of my lot anywhere near any of my machines My Wife has a Win7 box for work and I have an old XP machine that I let the kids use when they visit. Apart from that all my Linux boxes and my various Android devices are locked down ... *that's* when I rest easy :-) Anyway, with judicious use of virtualbox snapshots I have no got to the state where I can reset the vm to a single, no password, Joe User 'Administrator' account when I bugger things up ... and it way too easy to bugger things up. Example: * Single create on install Joe User admin ac no pwd * log in to Joe User the WinKey + x, choose Command Prompt(admin) * net user "Joe User" /active:no * log out WTF!!!, now I'm locked out. Where is the logic in this? Why does this make sense? It's obvious: you're being punished for experimenting with Redmond's best planned OS :-) You could also log into an elevated command prompt and delete everything, or you could boot from a Linux CD and format your hard drive. A popular hardware trick some have tried is to drive around the railroad crossing gate, knowing you can beat the train. One or two people have survived that trick. The only one to blame for these things is...Oh let me think, I just can't figure that out... -- Gene E. Bloch (Stumbling Bloch) |
#19
|
|||
|
|||
Windows 8.1 User accounts
On 18/09/14 18:08, Gene E. Bloch wrote:
On Thu, 18 Sep 2014 11:06:53 +0100, Joe User wrote: On 17/09/14 22:41, Gene E. Bloch wrote: On Wed, 17 Sep 2014 20:46:17 +0100, Joe User wrote: On 17/09/14 20:25, Gene E. Bloch wrote: On Wed, 17 Sep 2014 20:11:59 +0100, Joe User wrote: snip Anyway, with judicious use of virtualbox snapshots I have no got to the state where I can reset the vm to a single, no password, Joe User 'Administrator' account when I bugger things up ... and it way too easy to bugger things up. Example: * Single create on install Joe User admin ac no pwd * log in to Joe User the WinKey + x, choose Command Prompt(admin) * net user "Joe User" /active:no * log out WTF!!!, now I'm locked out. Where is the logic in this? Why does this make sense? It's obvious: you're being punished for experimenting with Redmond's best planned OS :-) You could also log into an elevated command prompt and delete everything, or you could boot from a Linux CD and format your hard drive. Believe me, if it was up to me I have one box running Ubuntu for the beginners, one running Mageia for the more adventurous, one running CentOS for the wannabe admins and one running Slackware for the nutters but as it is I'm stuck with this nonsense. A popular hardware trick some have tried is to drive around the railroad crossing gate, knowing you can beat the train. One or two people have survived that trick. The only one to blame for these things is...Oh let me think, I just can't figure that out... It *has* to be my fault ... doesn't it? Now I just gotta explain all this to my fellow helpers. Thanks for taking the time, it's been most helpful. -- Not confused, just ... bewildered |
#20
|
|||
|
|||
Windows 8.1 User accounts
On Thu, 18 Sep 2014 19:46:51 +0100, Joe User wrote:
The only one to blame for these things is...Oh let me think, I just can't figure that out... It *has* to be my fault ... doesn't it? You got it! I have to say, it's fun assigning blame - especially to people like you who won't take it seriously. In conversation, I have a similar problem to Usenet, where my poker face is too good (I apparently don't realize I'm doing it). -- Gene E. Bloch (Stumbling Bloch) |
#21
|
|||
|
|||
Windows 8.1 User accounts
On 18/09/14 22:14, DK wrote:
In article , Joe User wrote: On 13/09/14 18:19, Joe User wrote: Good afternoon I am helping out at a local charity drop in center I have 4 * 6 month old Windows 8.1 machines and I'm trying to understand the whole user account thing. I'm actually more used to managing *nix accounts so this is proving a little 'challenging' to say the least. snip Thanks to all the responders so far I think I have figured out what is supposed to happen when you do a fresh install. This is just a sanity check really, any advice most welcome. When I do a fresh install (win 8.1) I create an account, I do not supply a password. When everything is installed I do WinKey + x and select Command Prompt(Admin). At the command prompt I type net user Administrator /active:yes Great - you figured out the most retarded feature of Win 8.*: an account with admin privileges does not have full control of the system. it takes an account hard-wired to be calles "Administrator" to have a semblance of the root in Unix. Well actually it's kind of making sense now When you install (say) Ubuntu you create an account during installation, this account is in sudoers. You log in as your user and issue sudo passwd root you set the root password then you can login to the root account and disable the ability of sudoers to change the root password (I forget how to do this OTTOMH). In 8.1 you create your (effectively) sudoers account during install, log in and enable the Administrator 'SuperUser' account. You can then set the password for the Administrator. So far so good, now what I want to do is to disable the ability of the (sudoers) account(s) to change the superusers password. Can't figure that out at the moment, sigh, keep digging around in the guts of win8 ... Joe -- Not confused, just ... bewildered |
#22
|
|||
|
|||
Windows 8.1 User accounts
On Fri, 19 Sep 2014 10:48:26 +0100, Joe User wrote:
On 18/09/14 22:14, DK wrote: In article , Joe User wrote: On 13/09/14 18:19, Joe User wrote: Good afternoon I am helping out at a local charity drop in center I have 4 * 6 month old Windows 8.1 machines and I'm trying to understand the whole user account thing. I'm actually more used to managing *nix accounts so this is proving a little 'challenging' to say the least. snip Thanks to all the responders so far I think I have figured out what is supposed to happen when you do a fresh install. This is just a sanity check really, any advice most welcome. When I do a fresh install (win 8.1) I create an account, I do not supply a password. When everything is installed I do WinKey + x and select Command Prompt(Admin). At the command prompt I type net user Administrator /active:yes Great - you figured out the most retarded feature of Win 8.*: an account with admin privileges does not have full control of the system. it takes an account hard-wired to be calles "Administrator" to have a semblance of the root in Unix. Well actually it's kind of making sense now When you install (say) Ubuntu you create an account during installation, this account is in sudoers. You log in as your user and issue sudo passwd root you set the root password then you can login to the root account and disable the ability of sudoers to change the root password (I forget how to do this OTTOMH). In 8.1 you create your (effectively) sudoers account during install, log in and enable the Administrator 'SuperUser' account. You can then set the password for the Administrator. So far so good, now what I want to do is to disable the ability of the (sudoers) account(s) to change the superusers password. Can't figure that out at the moment, sigh, keep digging around in the guts of win8 ... Joe I'm rather sure that you can't change the 'root' password unless you know the existing one. Naturally, in the normal course of affairs the person who created the Administrator level account would also be the person who created The Administrator's password. Nonetheless, if you walk away from your computer leaving it logged into your Admin-level account, and while you're away, I try to change the Administrator password, I'd be SOL without knowing the current PW. I don't want to experiment to verify my first remark, because I don't want to mess up :-) Aside to DK: this dichotomy between the two kinds of Administrator accounts predates W8 by a long shot, and IMO there are sound security reasons for it. In fact, it's a bit like what Joe User described above for sudoers passwords, albeit with less user choice. -- Gene E. Bloch (Stumbling Bloch) |
#23
|
|||
|
|||
Windows 8.1 User accounts
On 19/09/14 18:38, Gene E. Bloch wrote:
On Fri, 19 Sep 2014 10:48:26 +0100, Joe User wrote: On 18/09/14 22:14, DK wrote: In article , Joe User wrote: On 13/09/14 18:19, Joe User wrote: Good afternoon snip Nonetheless, if you walk away from your computer leaving it logged into your Admin-level account, and while you're away, I try to change the Administrator password, I'd be SOL without knowing the current PW. Not at all, as an Administrator you can change any other Administrator password. even the 'default', no password, create on install, 'Administrator' can change the net user Administrator /active:yes hidden, default, hardcoded or whatever the **** they call it account password without knowing the original ... and there doesn't seem to be a way to prevent it. I know this because I have tested it repeatedly using a virtualbox snapshot so I don't have to keep re-installing. I have also tested on one of the 'real' Windozy boxes. I asked a question on a MS 'support' forum and was told that an Admin is an Admin is an Admin so I asked what the point of the hidden Administrator account was if anyone (any admin for the pedantic out there) can enable/disable change the password of and generally mess about with this mystical seemingly pointless account and have so far been met with a deafening silence. I don't want to experiment to verify my first remark, because I don't want to mess up :-) Install a Virtual Machine manager. Aside to DK: this dichotomy between the two kinds of Administrator accounts predates W8 by a long shot, and IMO there are sound security reasons for it. In fact, it's a bit like what Joe User described above for sudoers passwords, albeit with less user choice. But there is no difference that I can see or find out about. The sudoers thing is a red herring I mistakenly introduced, it's nothing like sudo, with sudo you can restrict what the sudoer can do. With Windows 8.1 admin user accounts apparently you can't. I can't believe this is actually the case so will continue to look into it ... I'm getting a bit of a sinking feeling that I might be wasting my time though. And to think people actually *pay money* for this nonsense. -- Not confused, just ... bewildered |
#24
|
|||
|
|||
Windows 8.1 User accounts
On Fri, 19 Sep 2014 19:57:11 +0100, Joe User wrote:
And to think people actually *pay money* for this nonsense. Switch to Linux, you'll no doubt be happier. I have a VM running XP, but I don't wont to bother running that ATM, so I'll just do the experiment here, since I really won't screw up. -- Gene E. Bloch (Stumbling Bloch) |
#25
|
|||
|
|||
Windows 8.1 User accounts
On Fri, 19 Sep 2014 12:08:50 -0700, Gene E. Bloch wrote:
On Fri, 19 Sep 2014 19:57:11 +0100, Joe User wrote: And to think people actually *pay money* for this nonsense. Switch to Linux, you'll no doubt be happier. I have a VM running XP, but I don't wont to bother running that ATM, so I'll just do the experiment here, since I really won't screw up. I tried to change my own account's PW, since Administrator is currently not enabled. The first box in the change PW dialog asks for my current password. The other available accounts are all standard users; they don't require me (an Administrator) to know their passwords. After lunch I'll enable the Admin and switch user for an additional experiment. -- Gene E. Bloch (Stumbling Bloch) |
#26
|
|||
|
|||
Windows 8.1 User accounts
On 19/09/14 20:08, Gene E. Bloch wrote:
On Fri, 19 Sep 2014 19:57:11 +0100, Joe User wrote: And to think people actually *pay money* for this nonsense. Switch to Linux, you'll no doubt be happier. I have a VM running XP, but I don't wont to bother running that ATM, so I'll just do the experiment here, since I really won't screw up. Check the headers, I only run Linux. But the charity doesn't and I need to lock those machines down. -- Not confused, just ... bewildered |
#27
|
|||
|
|||
Windows 8.1 User accounts
On Fri, 19 Sep 2014 20:19:01 +0100, Joe User wrote:
On 19/09/14 20:08, Gene E. Bloch wrote: On Fri, 19 Sep 2014 19:57:11 +0100, Joe User wrote: And to think people actually *pay money* for this nonsense. Switch to Linux, you'll no doubt be happier. I have a VM running XP, but I don't wont to bother running that ATM, so I'll just do the experiment here, since I really won't screw up. Check the headers, I only run Linux. But the charity doesn't and I need to lock those machines down. 1. You are right - my user account can change the Administrator password w/o knowledge of the current password. Now I believe you! As you always did :-) Time to grovel: I was wrong. 2. It turns out to be a good thing for me today. The Administrator account would not accept the password I had given it. Now it does. The old password was one that I remember, but I also rechecked it in my password file. If I had changed it, I didn't record the fact... 3. My neighbor lost his password recently. I was able to create a new one without booting to his Windows. There are a few recipes online for doing this... 4. Given statement 1 & 3 above, you are right to worry... 5. And I can't help. And I bet you find that statement believable :-) 6. Thanks for forcing me to learn something (no sarcasm; I'm glad to learn). -- Gene E. Bloch (Stumbling Bloch) |
#28
|
|||
|
|||
Windows 8.1 User accounts
Gene E. Bloch wrote:
1. You are right - my user account can change the Administrator password w/o knowledge of the current password. Was that user account was a standard user account ? -- ...winston msft mvp consumer apps |
#29
|
|||
|
|||
Windows 8.1 User accounts
On Sat, 20 Sep 2014 02:38:20 -0400, . . .winston wrote:
Gene E. Bloch wrote: 1. You are right - my user account can change the Administrator password w/o knowledge of the current password. Was that user account was a standard user account ? No, it was an admin account. I didn't even bother with testing a standard account. -- Gene E. Bloch (Stumbling Bloch) |
#30
|
|||
|
|||
Windows 8.1 User accounts
Gene E. Bloch wrote:
On Sat, 20 Sep 2014 02:38:20 -0400, . . .winston wrote: Gene E. Bloch wrote: 1. You are right - my user account can change the Administrator password w/o knowledge of the current password. Was that user account was a standard user account ? No, it was an admin account. I didn't even bother with testing a standard account. Which then raises the question...if one wishes to keep other user's from changing things on a system, why not password protect the Admin account and create standard users accounts for the others. -- ...winston msft mvp consumer apps |
Thread Tools | |
Display Modes | Rate This Thread |
|
|