Vista permissions: How to use effectively?

[lazer_viking]

I just recently moved my computer to my girlfriend's house where it will get much more use. There will be about seven different accounts, one for each member of her family. When my computer was at my house, I was the only one to use it so I didn't pay much attention to what I put on my computer, or where I put it.

I was reading a little bit about permissions, and when you make an account you get two choices: Administrator and Standard User. Standard User says, ¨Can use most programs¨. What programs are there that they can't use?
Also, what is the difference between Administrator and Standard User other than the fact they can't edit other people's accounts? If you set a User Account to have full control of a drive, that's just as good as Administrator right?

Basically what I want to do is this: For MY account, I would like to have full control of everything. I want to have access to everyone's folders, etc. They understand it's my computer and some of them are known for downloading nefarious material to the computer like free screensavers and smilies.
For everyone else, I would like them only to have access to what is needed to run the computer, and the programs inside \Program Files\, and \Program Files (x86)\. I do not want them to be able to look into other people's folders, or change drivers. Also, there are a few programs I would like them to not have access to such as Rivatuner. I'm sure by setting the permissions of their account to deny access to \Program Files (x86\RivaTuner\, I can accomplish this, correct?

Another thing I'm confused about is why are there so many groups/users? Under the permissions tab, there are at least 5 different groups even when I was the only user of the computer. There's SYSTEM, CREATOR OWNER, Users, Administrators, and Mike. If I, for example, deny all those groups access to the D:\ drive, but give Mike full control, does Mike still get locked out of the D:\ drive because he falls into the category of User, Administrator, and CREATOR OWNER? The reason I ask such a specific question is because I think I locked everyone out of the D:\ drive and I don't know how to get it back. Even when I log in using Safe Mode, I don't get access to an Administrator user like I did in XP. Is the D:\ drive gone forever now? The D:\ drive is a physical internal hard drive with lots of backups and old games that I probably won't be able to find again.

 

[KSoD]

Hello,

there are some applications that require Admin rights to run. It is all dependent on the applicaiton. So cant give you a list of what apps this entails as each software is different and no one has made a list like that yet.

A standard user will not have full rights even if you give them rights to a drive. They will still need Admin password to perform things like application installs and editing of files. Unless you went into the Security tab to give the standard users the full rights there. That might bypass that part of the UAC. But to install software they will need the Admin password.

So for your account i would keep it as admin. Use the rest as standard. Also you can make use of the permissions to allow a standard user on at a specific time and not at any other time to make sure that someone isnt using the PC when they shoudnt be.

They will not be able to see what is in someones else profile folder or anything like that as a standard user. But if you give them full rights thru the security tab then they could. So i would advise against that. But the stuff that they want to downlaod wouldnt be allowed cause of UAC and needing your password.

Yes you can deny permissions to apps as well.

As for the user thing i would be careful there as well. The Admin needs to have rights to everything. You remove the rights to a drive then basically they are not admin and can not allow things to be done with that drive.

Each user should be listed. Some might fall under the general catagories but if you denied access to a user to a drive and Mike is a part of that group Mike would lose rights to that drive as well. As Mike is sitll classified as that type of user.

The only way i know of to be able to get that drive back would be thru the hidden Admin account.

I hope i got most of the stuff covered....

Cheers,
Mak

 

[lazer_viking]

How do I access the hidden Administrator account? I guess I'll start with one problem at a time; the first problem being that no one can get to D:\.

Administrator account did not help. It still said access denied, even for the hidden admin account. I could view the files though with the admin account, so I copied them all over to the C:\ drive, and I plan to format the D:\ drive and copy it all back over.

After this, how to I limited access to the D:\ drive? Do I just deny permission to all the Users? Do administrator accounts count as Users?

edit: realisation... all those files I'm copying are going to have the same permissions set on them aren't they? This isn't going to help, is it?

 

[KSoD]

Hello,

You will have to remove that drive from the device manager and hope that when you restart you can get the drive back and without any restrictions.

Cheers,
Mak