Can a standard user access the Admin account via Safe Mode?

Posted: 11-09-2008, 07:05 PM

I have a situation where I want to be the administrator for my son's
laptop, and convert him to a standard (non-admin) account. He originally
set up the laptop, giving himself admin privileges, but he is no longer
allowed to use it in that condition

I am now the passworded local admin account (same account used to
install Vista), and AFAIK do not have the system Administrator
(upper-case A) account activated. He has a "standard" account. However,
he is clever, and will try to work-around to get admin access. I've read
the "recover password / activate Admin /etc." links in the forum, and I
have a few questions:

1. Can my local admin account OR the system Admin account be accessed
and altered by a standard user in Safe Mode?

2. Is it possible to block Method 3 (DVD boot for password reset) if
the system is already properly set up for one admin's access?

3. I do not see the "user groups" folder in Comp Mmgt Control Panel to
enable or disable the system Admin account. How can I check its status?

BTW, I'm using Vista Home Basic.

Thanks,
mgr


--
mgr

Can a standard user access the Admin account via Safe Mode?


Responses to "Can a standard user access the Admin account via Safe Mode?"

barman58
Guest
Posts: n/a
 
Re: Can a standard user access the Admin account via Safe Mode?
Posted: 11-09-2008, 07:23 PM

Hello Mgr and welcome to the vista forums arty

First thing you may want to check is vista's built-in parental control
..

'Explore the features: Parental controls
(http://www.microsoft.com/windows/win...-controls.aspx

which should allow you to set limits for any standard account from you
administrator account

as for the booting of a password reset cd or dvd which cannot b
controlled from vista as it boots before vista does, the only way I ca
advise is this

go into the BIOS of the laptop and either remove the cd drive from th
boot devices or set it to after the hard drive. that will stop anyon
gaining access to the drive before vista boots. you should then be abl
to password protect the changing of the BIOS with a password No
foolproof - I have professional software that can defeat this but it i
not generally available

If you need to boot from a CD/DVD yourself it is a fairly simple matte
to log into the BIOS change the setting and reboo

hope this helps ..

--
barman5

Regards,
*Nigel*
the beginning of knowledge is the discovery of something we do no
understand.,- frank herbert
FromTheRafters
Guest
Posts: n/a
 
Re: Can a standard user access the Admin account via Safe Mode?
Posted: 11-09-2008, 09:56 PM

"mgr" <guest@unknown-email.com> wrote in message
news:4decb1bab7b24203b8b99d370510f94b@nntp-gateway.com...
>
> I have a situation where I want to be the administrator for my son's
> laptop, and convert him to a standard (non-admin) account. He originally
> set up the laptop, giving himself admin privileges, but he is no longer
> allowed to use it in that condition
>
> I am now the passworded local admin account (same account used to
> install Vista),
Not really, that account was created afterward.
> and AFAIK do not have the system Administrator
> (upper-case A) account activated. He has a "standard" account. However,
> he is clever, and will try to work-around to get admin access.
Activate and create a password for the *real* administrator, then
deactivate it again. That way he won't be able to easily access that
account.
> I've read
> the "recover password / activate Admin /etc." links in the forum, and I
> have a few questions:
>
> 1. Can my local admin account OR the system Admin account be accessed
> and altered by a standard user in Safe Mode?
It shouldn't be possible.
> 2. Is it possible to block Method 3 (DVD boot for password reset) if
> the system is already properly set up for one admin's access?
Disable or resequence the CD/DVD boot option in the CMOS and
apply a password to the CMOS to make it more difficult to modify.
> 3. I do not see the "user groups" folder in Comp Mmgt Control Panel to
> enable or disable the system Admin account. How can I check its status?
Type "net user Administrator" at the command prompt.

Type "net help user|more" at the command prompt for usage of the
net user command switches and options.



mgr
Guest
Posts: n/a
 
Re: Can a standard user access the Admin account via Safe Mode?
Posted: 11-12-2008, 01:00 AM

All

Appreciate the informative replies. Looks like I have a number o
options to prevent workarounds. I'm _-hoping_- I don't have to do any o
these yet

I'm still curious about that first established account, though. It'
true the account didn't exist until we got the laptop (as Vista wa
already installed) but I've read that any changes to that first accoun
(e.g. changing it from an admin to standard and creating a new admin
can create serious problems. Are people really referring to the syste
Admin account in these situations

Thanks
mg

--
mgr
FromTheRafters
Guest
Posts: n/a
 
Re: Can a standard user access the Admin account via Safe Mode?
Posted: 11-12-2008, 03:21 AM
"mgr" <guest@unknown-email.com> wrote in message
news:8cebcfb932676e6ba49f413724d4f087@nntp-gateway.com...
>
> All,
>
> Appreciate the informative replies. Looks like I have a number of
> options to prevent workarounds. I'm _-hoping_- I don't have to do any of
> these yet.
>
> I'm still curious about that first established account, though. It's
> true the account didn't exist until we got the laptop (as Vista was
> already installed) but I've read that any changes to that first account
> (e.g. changing it from an admin to standard and creating a new admin)
> can create serious problems. Are people really referring to the system
> Admin account in these situations?
When Vista sets up, it creates the "Administrator" account. After that
it sets up the split token user/administrator account and disables the
"Administrator" account and hides it from the user.

The user/administrator is then prompted to create other standard user
accounts as desired. If for any reason the last available account with
administrator privileges is demoted or deleted - the OS should enable
the "Administrator" account and make it available in safe mode.

Unfortunately, it is possible to give the ASP.NET account administrator
privileges and then demote or delete all other accounts without the OS
enabling "Administrator". To the OS there is still an administrator level
account - the problem then is the access to that account.


barman58
Guest
Posts: n/a
 
Re: Can a standard user access the Admin account via Safe Mode?
Posted: 11-12-2008, 10:48 AM

Hi mgr

There is confusion as to when the FULL Administrator account i
available in vista

of course it may be enabled using the NET USER command and will the
appear in the log-in (by default with no password )

In XP when you entered Safe Mode you were automatically logged in a
the FULL administrator this is NOT the default for Vista. If howeve
there are no administrator accounts set-up in Vista then it is suppose
to revert to the XP system (as a fall-back to prevent lockout). I sa
"supposed" as I have seen lockouts where re-install was the only remedy

As for the first account created by the user in vista this is b
default an administrator account but as far as I am aware this is no
"special" in any way

This account may be removed, (by another later created administrator o
the FULL administrator account, but not if it's the only account on th
machine), and I believe it may also be downgraded to a standard use
even when it is the only administrator on the system, and this is wh
the reversion to XP behaviour was included for safe mode

Hope this helps ..

--
barman5

Regards,
*Nigel*
the beginning of knowledge is the discovery of something we do no
understand.,- frank herbert
FromTheRafters
Guest
Posts: n/a
 
Re: Can a standard user access the Admin account via Safe Mode?
Posted: 11-12-2008, 01:13 PM
"barman58" <guest@unknown-email.com> wrote in message
news:0a563722690fa961418c09b21397d6a5@nntp-gateway.com...
> As for the first account created by the user in vista this is by
> default an administrator account but as far as I am aware this is not
> "special" in any way.
It is "special" in that it uses a split token (as opposed to the full
token in the *real* administrator account). The account runs as
a standard user until an action is requested that requires admin
privileges. It then will prompt the user to "consent" to using the
rest of the split token. They call this Admin Approval Mode or
AAM for short.

The same action requested in a regular standard user account
will prompt the user to supply administrator credentials before
allowing the action to take place.


mgr
Guest
Posts: n/a
 
Re: Can a standard user access the Admin account via Safe Mode?
Posted: 11-14-2008, 02:02 AM

Nigel,

Thanks, that makes sense. Again, I appreciate the help.

mgr


--
mgr
 
LinkBack Thread Tools Display Modes
 


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On
Forum Jump


Similar Threads
Thread Thread Starter Forum Replies Last Post
Cant find my standard user account files when logged in as Admin?? DarFromVa Windows Vista Administration 2 10-11-2007 04:10 AM
Standard User works like admin account jcraig33 Windows Vista Administration 6 06-15-2007 02:17 AM
Create a new user account in Safe Mode? Ken Windows XP Configuration & Management 1 11-03-2006 01:20 AM
Can't Access Enabled Administrator Account in Safe Mode yanyao Windows Vista Administration 0 08-22-2006 01:12 AM
New User Account removed MY administrator access to safe-mode only brahmadomtao Windows XP Accessibility 1 01-19-2005 11:47 PM