Comments for Are Limited User Accounts effective?

Comment from Alex on 2007-11-26

2007-11-26T13:27:44Z

I have setup my system exactly as described and since I don't use games (which are the ones that are most fiddly about permission rights) everything works fine without hickups or hassles. Admin accounts is ONLY for installation of new programs.

I DO wonder how protected I am with this scheme. Knowing a little about how permissions work with NTFS, I can't figure how a virus could bypass this. Of course there is a way because enterprises get viruses just as anybody else (albeit not as often) and in a corporate environment LUA is exactly the norm. So how do viruses do it? If they can't get write access to the registry, how do they make themselves executable on system restarts?

]]>

A comment on: Are Limited User Accounts effective?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Alex on 2007-11-26

2007-11-26T13:18:58Z

I believe many people are not aware that it is possible to run an application in a LUA with administrator rights (provided you have the password). The feature is called "Run as..." and is accessible through right-click in Explorer on the program you want to execute. It will only be valid for the current session and is an excellent way of quickly getting things installed or configured without the hassle of temporarily elevating permission rights. It is even possible to setup a shortcut or program to always run as a different account (although I wouldn't recommend that as a design, it's a compromise for the exceptions).

]]>

A comment on: Are Limited User Accounts effective?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Grant Phillips on 2007-09-30

2007-09-30T14:14:21Z

I have windows vista and I have asked Dell, as well as my IP. how can seperate two users in email. Right now my wife's email comes in my acct. and if she sends it goes out in my name not hers.

]]>

A comment on: Are Limited User Accounts effective?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Jim on 2006-12-03

2006-12-04T01:31:21Z

In early 2006, I found a reference to a small program on Microsoft's website called DropMyRights. It's used with user setup desktop shortcuts to fire-up DropMyRights which then starts ups another program (such as Internet Exporer, Firefox, Outlook Express) with LimitedUser rights (non-Administrator). I've been using it for the 3 programs above for most of 2006. When I look at the security setting of any of these DropMyRights invoked programs using ProcessExplorer (from SysInternals), ...right-click application name > Properties > Security tab > BUILTIN/Administrators setting: it shows "Deny,Owner" rather than "Owner". I think that for WinXP, this is a pretty good compromise. I can logon with Administrator rights, but then fire up some programs such as browsers and email with LimitedUser rights. I think that this protects me pretty well! I get the benefits of the need for Administrator rights with many applications as well as the protection of LimitedUser rights with my Internet facing applications. I keep my standard desktop icons for browsers, etc. for WindowsUpdate and other such work.

]]>

A comment on: Are Limited User Accounts effective?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Gordon on 2006-12-03

2006-12-03T11:10:31Z

I have added a Limited account to the computer that I most use for Web Wandering and intend to use that account only for that purpose. Is this sensible?

]]>

A comment on: Are Limited User Accounts effective?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Mike on 2006-11-21

2006-11-22T02:39:23Z

>> What I *don't* know is how often that requirement (administrative access) pops up in what would otherwise be "normal" work.

Anecdotally, I read that this was one of the biggest complaints about the early RC's for Vista..that even in trivial tasks like deleting a file from your desktop, Vista would password-prompt you (not once, not twice, but) *three* times. However, Microsoft has corrected this in later RCs, and supposedly trimmed down the number of tasks that require entering a password.

]]>

A comment on: Are Limited User Accounts effective?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo Notenboom on 2006-11-21

2006-11-22T00:05:09Z

The Mac is much like Ubuntu in this regard, and I agree, it's perhaps the most elegant compromise.

What I *don't* know is how often that requirement (administrative access) pops up in what would otherwise be "normal" work. That's what's most frustrating about XP's LUA.

]]>

A comment on: Are Limited User Accounts effective?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Mike on 2006-11-21

2006-11-21T18:10:52Z

Windows Vista finally has a practical LUA implementation, many many years overdue, and linux has always had it. The implementation in Ubuntu is really quite elegant. Everyone is defaulted to a power user account, and if you'd like to perform a root-level task, you're simply asked for your password.

]]>

A comment on: Are Limited User Accounts effective?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.