Standard Users Privileges

Sam

With Vista Ultimate you have the resources provided by the Group Policy
(gpedit.msc) and the Security Policy (SecPol.msc) components.

These tools can accomplish just about anything you need to open or lock down
any component in the system. It may take you a short time to learn, but it
is well worth the effort.

Resources for Learning About Group Policy for Windows Vista:
http://technet2.microsoft.com/Window...0ef971033.mspx

Download details: Group Policy Settings Reference:
http://www.microsoft.com/downloads/d...DisplayLang=en

--

Ronnie Vernon
Microsoft MVP
Windows Shell/User


"Sam" <Sam@discussions.microsoft.com> wrote in message
news:BCF32B12-C752-42F5-A274-BC8E6F3E7963@microsoft.com...

> My goal, when I bought a new Windows Vista Ultimate computer for my son's
> 8th
> grade graduation, was to give him a tool to do his high school research
> and
> homework, at the same time controlling the time that he spent on the
> computer
> playing games. He spent too much time playing online game in middle
> school
> and his grades suffered as a result.
>
> When I configured Windows Vista Ultimate, I setup myself as the Vista
> Administrator and set him up as a Vista Standard User. Then I enabled
> Parental Controls and set computer usage time limits.
>
> However, as a Windows Vista Ultimate Standard User, he cannot download
> research or other files from the internet and/or he cannot install any
> programs (educational or not).
>
> The bottom line is that I want give him all the rights of a Windows Vista
> Administrator, with the following exceptions:
> * I do not want to let him remove or modify the Parental Controls in any
> way
> * I do not want to let him change his own or other peoples privileges.
> * I do not want him to change other user's, like his sister, password,
> but
> he should be able to change his own password.
> * I do not want him to change the Windows Live OneCare firewall and other
> settings. Windows Live OneCare should block him from downloading and
> installing spyware or viruses.
>
> Can someone please tell me how to enable this in Windows Vista Ultimate?
>
> Thanks,
>
> Sam
> Software Quality Assurance (SQA) Engineer
>

"Gistcheckin" wrote:

> Installing a Package with Elevated Privileges for a Non-Admin
> http://msdn2.microsoft.com/en-us/library/aa369519.aspx

I looked at the url and the first registry entry was in my registry but the
second one was not:

HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Win dows\Installer

What should I do about that?

Thanks,

Sam M.
Software Quality Assurance (SQA) Engineer

> --
> Gistcheckin
>
>
> "Sam" wrote:
>

> > My goal, when I bought a new Windows Vista Ultimate computer for my son's 8th
> > grade graduation, was to give him a tool to do his high school research and
> > homework, at the same time controlling the time that he spent on the computer
> > playing games. He spent too much time playing online game in middle school
> > and his grades suffered as a result.
> >
> > When I configured Windows Vista Ultimate, I setup myself as the Vista
> > Administrator and set him up as a Vista Standard User. Then I enabled
> > Parental Controls and set computer usage time limits.
> >
> > However, as a Windows Vista Ultimate Standard User, he cannot download
> > research or other files from the internet and/or he cannot install any
> > programs (educational or not).
> >
> > The bottom line is that I want give him all the rights of a Windows Vista
> > Administrator, with the following exceptions:
> > * I do not want to let him remove or modify the Parental Controls in any way
> > * I do not want to let him change his own or other peoples privileges.
> > * I do not want him to change other user's, like his sister, password, but
> > he should be able to change his own password.
> > * I do not want him to change the Windows Live OneCare firewall and other
> > settings. Windows Live OneCare should block him from downloading and
> > installing spyware or viruses.
> >
> > Can someone please tell me how to enable this in Windows Vista Ultimate?
> >
> > Thanks,
> >
> > Sam
> > Software Quality Assurance (SQA) Engineer
> >

I looked at the two URLS that you offered me and I didn't see anything that
told me clearly and specifically what to do to accomplish what I want to do.
I have a home network with no Active Directory Domain.

Maybe I am slow, but I posed specific authorizations and/or polices that I
wanted in place and I didn't see anything that showed my how to created a
user that could download files, install programs and change his password -
yet NOT be about to change other peoples passwords and change and/or remove
the parental controls.

Can you please break it down to the basic steps?
What happened to the concept of the Power Users group?

Still stumped...
Sam
Software Quality Assurance (SQA) Engineer



"Ronnie Vernon MVP" wrote:

> Sam
>
> With Vista Ultimate you have the resources provided by the Group Policy
> (gpedit.msc) and the Security Policy (SecPol.msc) components.
>
> These tools can accomplish just about anything you need to open or lock down
> any component in the system. It may take you a short time to learn, but it
> is well worth the effort.
>
> Resources for Learning About Group Policy for Windows Vista:
> http://technet2.microsoft.com/Window...0ef971033.mspx
>
> Download details: Group Policy Settings Reference:
> http://www.microsoft.com/downloads/d...DisplayLang=en
>
> --
>
> Ronnie Vernon
> Microsoft MVP
> Windows Shell/User
>
>
> "Sam" <Sam@discussions.microsoft.com> wrote in message
> news:BCF32B12-C752-42F5-A274-BC8E6F3E7963@microsoft.com...

> > My goal, when I bought a new Windows Vista Ultimate computer for my son's
> > 8th
> > grade graduation, was to give him a tool to do his high school research
> > and
> > homework, at the same time controlling the time that he spent on the
> > computer
> > playing games. He spent too much time playing online game in middle
> > school
> > and his grades suffered as a result.
> >
> > When I configured Windows Vista Ultimate, I setup myself as the Vista
> > Administrator and set him up as a Vista Standard User. Then I enabled
> > Parental Controls and set computer usage time limits.
> >
> > However, as a Windows Vista Ultimate Standard User, he cannot download
> > research or other files from the internet and/or he cannot install any
> > programs (educational or not).
> >
> > The bottom line is that I want give him all the rights of a Windows Vista
> > Administrator, with the following exceptions:
> > * I do not want to let him remove or modify the Parental Controls in any
> > way
> > * I do not want to let him change his own or other peoples privileges.
> > * I do not want him to change other user's, like his sister, password,
> > but
> > he should be able to change his own password.
> > * I do not want him to change the Windows Live OneCare firewall and other
> > settings. Windows Live OneCare should block him from downloading and
> > installing spyware or viruses.
> >
> > Can someone please tell me how to enable this in Windows Vista Ultimate?
> >
> > Thanks,
> >
> > Sam
> > Software Quality Assurance (SQA) Engineer
> >

>

Migrating from the Power Users Group
The Power Users group in Windows XP was designed to enable members of the
group to perform system tasks, such as installing applications without
granting full administrator permissions. Power Users also had write access to
areas of the file system and registry that normally only allow administrator
access. Power Users enabled some level of application compatibility;
unfortunately, this did not address a fundamental problem: applications
requiring unnecessary privileges and user rights. UAC does not leverage the
Power Users group, and the permissions granted to the Power Users group on
Windows XP have been removed from Windows Vista. UAC enables standard users
to perform all common configuration tasks. The Power Users group, however, is
still available for backwards compatibility with other versions of Windows.
To use the Power Users group on Windows Vista, a new security template must
be applied to change the default permissions on system folders and the
registry to grant Power Users group permissions equivalent to Windows XP.

To disable UAC from prompting for credentials to install applications

1. Click Start, click All Programs, click Accessories, click Run, type
secpol.msc in the Open text box, and then click OK.

2. From the Local Security Settings console tree, click Local Policies, and
then Security Options.

3. Scroll down and double-click User Account Control: Detect application
installations and prompt for elevation.

4. From the User Account Control: Detect application installations and
prompt for elevation Properties dialog box, click Disabled, and then click OK.

5. Close the Local Security Settings window.


To change the elevation prompt behavior

1. Click Start, click Accessories, click Run, type secpol.msc in the Open
text box, and then click OK.

2. From the Local Security Settings console tree, click Local Policies, and
then Security Options.

3. Scroll down to and double-click User Account Control: Behavior of the
elevation prompt for administrators or User Account Control: Behavior of the
elevation prompt for standard users.

4. From the drop-down menu, select one of the following settings:

• No prompt

• Prompt for credentials (this setting requires user name and password input
before an application or task will run as elevated, and is the default for
standard users)

• Prompt for consent (this is the default setting for administrators only)


5. Click OK.

6. Close the Local Security Settings window.


http://technet2.microsoft.com/Window....mspx?mfr=true



--
Gistcheckin


"Sam" wrote:

> I looked at the two URLS that you offered me and I didn't see anything that
> told me clearly and specifically what to do to accomplish what I want to do.
> I have a home network with no Active Directory Domain.
>
> Maybe I am slow, but I posed specific authorizations and/or polices that I
> wanted in place and I didn't see anything that showed my how to created a
> user that could download files, install programs and change his password -
> yet NOT be about to change other peoples passwords and change and/or remove
> the parental controls.
>
> Can you please break it down to the basic steps?
> What happened to the concept of the Power Users group?
>
> Still stumped...
> Sam
> Software Quality Assurance (SQA) Engineer
>
>
>
> "Ronnie Vernon MVP" wrote:
>

> > Sam
> >
> > With Vista Ultimate you have the resources provided by the Group Policy
> > (gpedit.msc) and the Security Policy (SecPol.msc) components.
> >
> > These tools can accomplish just about anything you need to open or lock down
> > any component in the system. It may take you a short time to learn, but it
> > is well worth the effort.
> >
> > Resources for Learning About Group Policy for Windows Vista:
> > http://technet2.microsoft.com/Window...0ef971033.mspx
> >
> > Download details: Group Policy Settings Reference:
> > http://www.microsoft.com/downloads/d...DisplayLang=en
> >
> > --
> >
> > Ronnie Vernon
> > Microsoft MVP
> > Windows Shell/User
> >
> >
> > "Sam" <Sam@discussions.microsoft.com> wrote in message
> > news:BCF32B12-C752-42F5-A274-BC8E6F3E7963@microsoft.com...

> > > My goal, when I bought a new Windows Vista Ultimate computer for my son's
> > > 8th
> > > grade graduation, was to give him a tool to do his high school research
> > > and
> > > homework, at the same time controlling the time that he spent on the
> > > computer
> > > playing games. He spent too much time playing online game in middle
> > > school
> > > and his grades suffered as a result.
> > >
> > > When I configured Windows Vista Ultimate, I setup myself as the Vista
> > > Administrator and set him up as a Vista Standard User. Then I enabled
> > > Parental Controls and set computer usage time limits.
> > >
> > > However, as a Windows Vista Ultimate Standard User, he cannot download
> > > research or other files from the internet and/or he cannot install any
> > > programs (educational or not).
> > >
> > > The bottom line is that I want give him all the rights of a Windows Vista
> > > Administrator, with the following exceptions:
> > > * I do not want to let him remove or modify the Parental Controls in any
> > > way
> > > * I do not want to let him change his own or other peoples privileges.
> > > * I do not want him to change other user's, like his sister, password,
> > > but
> > > he should be able to change his own password.
> > > * I do not want him to change the Windows Live OneCare firewall and other
> > > settings. Windows Live OneCare should block him from downloading and
> > > installing spyware or viruses.
> > >
> > > Can someone please tell me how to enable this in Windows Vista Ultimate?
> > >
> > > Thanks,
> > >
> > > Sam
> > > Software Quality Assurance (SQA) Engineer
> > >

> >

Hi Gistcheckin,

Thanks for the detailed advice! I will try it as soon as i go home tonight.

Will adding the users to the newly configured Power Users group still limit
them from changing the Parental Controls? If not, how can I specify that
policy for the Power Users group?

Thanks,
Sam M.
Software Quality Assurance (SQA) Engineer


"Gistcheckin" wrote:

> Migrating from the Power Users Group
> The Power Users group in Windows XP was designed to enable members of the
> group to perform system tasks, such as installing applications without
> granting full administrator permissions. Power Users also had write access to
> areas of the file system and registry that normally only allow administrator
> access. Power Users enabled some level of application compatibility;
> unfortunately, this did not address a fundamental problem: applications
> requiring unnecessary privileges and user rights. UAC does not leverage the
> Power Users group, and the permissions granted to the Power Users group on
> Windows XP have been removed from Windows Vista. UAC enables standard users
> to perform all common configuration tasks. The Power Users group, however, is
> still available for backwards compatibility with other versions of Windows.
> To use the Power Users group on Windows Vista, a new security template must
> be applied to change the default permissions on system folders and the
> registry to grant Power Users group permissions equivalent to Windows XP.
>
> To disable UAC from prompting for credentials to install applications
>
> 1. Click Start, click All Programs, click Accessories, click Run, type
> secpol.msc in the Open text box, and then click OK.
>
> 2. From the Local Security Settings console tree, click Local Policies, and
> then Security Options.
>
> 3. Scroll down and double-click User Account Control: Detect application
> installations and prompt for elevation.
>
> 4. From the User Account Control: Detect application installations and
> prompt for elevation Properties dialog box, click Disabled, and then click OK.
>
> 5. Close the Local Security Settings window.
>
>
> To change the elevation prompt behavior
>
> 1. Click Start, click Accessories, click Run, type secpol.msc in the Open
> text box, and then click OK.
>
> 2. From the Local Security Settings console tree, click Local Policies, and
> then Security Options.
>
> 3. Scroll down to and double-click User Account Control: Behavior of the
> elevation prompt for administrators or User Account Control: Behavior of the
> elevation prompt for standard users.
>
> 4. From the drop-down menu, select one of the following settings:
>
> • No prompt
>
> • Prompt for credentials (this setting requires user name and password input
> before an application or task will run as elevated, and is the default for
> standard users)
>
> • Prompt for consent (this is the default setting for administrators only)
>
>
> 5. Click OK.
>
> 6. Close the Local Security Settings window.
>
>
> http://technet2.microsoft.com/Window....mspx?mfr=true
>
>
>
> --
> Gistcheckin
>
>
> "Sam" wrote:
>

> > I looked at the two URLS that you offered me and I didn't see anything that
> > told me clearly and specifically what to do to accomplish what I want to do.
> > I have a home network with no Active Directory Domain.
> >
> > Maybe I am slow, but I posed specific authorizations and/or polices that I
> > wanted in place and I didn't see anything that showed my how to created a
> > user that could download files, install programs and change his password -
> > yet NOT be about to change other peoples passwords and change and/or remove
> > the parental controls.
> >
> > Can you please break it down to the basic steps?
> > What happened to the concept of the Power Users group?
> >
> > Still stumped...
> > Sam
> > Software Quality Assurance (SQA) Engineer
> >
> >
> >
> > "Ronnie Vernon MVP" wrote:
> >

> > > Sam
> > >
> > > With Vista Ultimate you have the resources provided by the Group Policy
> > > (gpedit.msc) and the Security Policy (SecPol.msc) components.
> > >
> > > These tools can accomplish just about anything you need to open or lock down
> > > any component in the system. It may take you a short time to learn, but it
> > > is well worth the effort.
> > >
> > > Resources for Learning About Group Policy for Windows Vista:
> > > http://technet2.microsoft.com/Window...0ef971033.mspx
> > >
> > > Download details: Group Policy Settings Reference:
> > > http://www.microsoft.com/downloads/d...DisplayLang=en
> > >
> > > --
> > >
> > > Ronnie Vernon
> > > Microsoft MVP
> > > Windows Shell/User
> > >
> > >
> > > "Sam" <Sam@discussions.microsoft.com> wrote in message
> > > news:BCF32B12-C752-42F5-A274-BC8E6F3E7963@microsoft.com...
> > > > My goal, when I bought a new Windows Vista Ultimate computer for my son's
> > > > 8th
> > > > grade graduation, was to give him a tool to do his high school research
> > > > and
> > > > homework, at the same time controlling the time that he spent on the
> > > > computer
> > > > playing games. He spent too much time playing online game in middle
> > > > school
> > > > and his grades suffered as a result.
> > > >
> > > > When I configured Windows Vista Ultimate, I setup myself as the Vista
> > > > Administrator and set him up as a Vista Standard User. Then I enabled
> > > > Parental Controls and set computer usage time limits.
> > > >
> > > > However, as a Windows Vista Ultimate Standard User, he cannot download
> > > > research or other files from the internet and/or he cannot install any
> > > > programs (educational or not).
> > > >
> > > > The bottom line is that I want give him all the rights of a Windows Vista
> > > > Administrator, with the following exceptions:
> > > > * I do not want to let him remove or modify the Parental Controls in any
> > > > way
> > > > * I do not want to let him change his own or other peoples privileges.
> > > > * I do not want him to change other user's, like his sister, password,
> > > > but
> > > > he should be able to change his own password.
> > > > * I do not want him to change the Windows Live OneCare firewall and other
> > > > settings. Windows Live OneCare should block him from downloading and
> > > > installing spyware or viruses.
> > > >
> > > > Can someone please tell me how to enable this in Windows Vista Ultimate?
> > > >
> > > > Thanks,
> > > >
> > > > Sam
> > > > Software Quality Assurance (SQA) Engineer
> > > >
> > >

I implemented your solution and it allowed a standard user to download and
install files like i wanted.

However, it also allowed the standard user to change the Parental Controls,
like I did NOT want.

Is there any way do enable a policy that does exactly what i requested?
Basically, I need to create "an administrator with limited rights"
--
Sam M.
Software Quality Assurance (SQA) Engineer



"Gistcheckin" wrote:

> Migrating from the Power Users Group
> The Power Users group in Windows XP was designed to enable members of the
> group to perform system tasks, such as installing applications without
> granting full administrator permissions. Power Users also had write access to
> areas of the file system and registry that normally only allow administrator
> access. Power Users enabled some level of application compatibility;
> unfortunately, this did not address a fundamental problem: applications
> requiring unnecessary privileges and user rights. UAC does not leverage the
> Power Users group, and the permissions granted to the Power Users group on
> Windows XP have been removed from Windows Vista. UAC enables standard users
> to perform all common configuration tasks. The Power Users group, however, is
> still available for backwards compatibility with other versions of Windows.
> To use the Power Users group on Windows Vista, a new security template must
> be applied to change the default permissions on system folders and the
> registry to grant Power Users group permissions equivalent to Windows XP.
>
> To disable UAC from prompting for credentials to install applications
>
> 1. Click Start, click All Programs, click Accessories, click Run, type
> secpol.msc in the Open text box, and then click OK.
>
> 2. From the Local Security Settings console tree, click Local Policies, and
> then Security Options.
>
> 3. Scroll down and double-click User Account Control: Detect application
> installations and prompt for elevation.
>
> 4. From the User Account Control: Detect application installations and
> prompt for elevation Properties dialog box, click Disabled, and then click OK.
>
> 5. Close the Local Security Settings window.
>
>
> To change the elevation prompt behavior
>
> 1. Click Start, click Accessories, click Run, type secpol.msc in the Open
> text box, and then click OK.
>
> 2. From the Local Security Settings console tree, click Local Policies, and
> then Security Options.
>
> 3. Scroll down to and double-click User Account Control: Behavior of the
> elevation prompt for administrators or User Account Control: Behavior of the
> elevation prompt for standard users.
>
> 4. From the drop-down menu, select one of the following settings:
>
> • No prompt
>
> • Prompt for credentials (this setting requires user name and password input
> before an application or task will run as elevated, and is the default for
> standard users)
>
> • Prompt for consent (this is the default setting for administrators only)
>
>
> 5. Click OK.
>
> 6. Close the Local Security Settings window.
>
>
> http://technet2.microsoft.com/Window....mspx?mfr=true
>
>
>
> --
> Gistcheckin
>
>
> "Sam" wrote:
>

> > I looked at the two URLS that you offered me and I didn't see anything that
> > told me clearly and specifically what to do to accomplish what I want to do.
> > I have a home network with no Active Directory Domain.
> >
> > Maybe I am slow, but I posed specific authorizations and/or polices that I
> > wanted in place and I didn't see anything that showed my how to created a
> > user that could download files, install programs and change his password -
> > yet NOT be about to change other peoples passwords and change and/or remove
> > the parental controls.
> >
> > Can you please break it down to the basic steps?
> > What happened to the concept of the Power Users group?
> >
> > Still stumped...
> > Sam
> > Software Quality Assurance (SQA) Engineer
> >
> >
> >
> > "Ronnie Vernon MVP" wrote:
> >

> > > Sam
> > >
> > > With Vista Ultimate you have the resources provided by the Group Policy
> > > (gpedit.msc) and the Security Policy (SecPol.msc) components.
> > >
> > > These tools can accomplish just about anything you need to open or lock down
> > > any component in the system. It may take you a short time to learn, but it
> > > is well worth the effort.
> > >
> > > Resources for Learning About Group Policy for Windows Vista:
> > > http://technet2.microsoft.com/Window...0ef971033.mspx
> > >
> > > Download details: Group Policy Settings Reference:
> > > http://www.microsoft.com/downloads/d...DisplayLang=en
> > >
> > > --
> > >
> > > Ronnie Vernon
> > > Microsoft MVP
> > > Windows Shell/User
> > >
> > >
> > > "Sam" <Sam@discussions.microsoft.com> wrote in message
> > > news:BCF32B12-C752-42F5-A274-BC8E6F3E7963@microsoft.com...
> > > > My goal, when I bought a new Windows Vista Ultimate computer for my son's
> > > > 8th
> > > > grade graduation, was to give him a tool to do his high school research
> > > > and
> > > > homework, at the same time controlling the time that he spent on the
> > > > computer
> > > > playing games. He spent too much time playing online game in middle
> > > > school
> > > > and his grades suffered as a result.
> > > >
> > > > When I configured Windows Vista Ultimate, I setup myself as the Vista
> > > > Administrator and set him up as a Vista Standard User. Then I enabled
> > > > Parental Controls and set computer usage time limits.
> > > >
> > > > However, as a Windows Vista Ultimate Standard User, he cannot download
> > > > research or other files from the internet and/or he cannot install any
> > > > programs (educational or not).
> > > >
> > > > The bottom line is that I want give him all the rights of a Windows Vista
> > > > Administrator, with the following exceptions:
> > > > * I do not want to let him remove or modify the Parental Controls in any
> > > > way
> > > > * I do not want to let him change his own or other peoples privileges.
> > > > * I do not want him to change other user's, like his sister, password,
> > > > but
> > > > he should be able to change his own password.
> > > > * I do not want him to change the Windows Live OneCare firewall and other
> > > > settings. Windows Live OneCare should block him from downloading and
> > > > installing spyware or viruses.
> > > >
> > > > Can someone please tell me how to enable this in Windows Vista Ultimate?
> > > >
> > > > Thanks,
> > > >
> > > > Sam
> > > > Software Quality Assurance (SQA) Engineer
> > > >
> > >

I believe you can restrict the User's Rights
http://technet2.microsoft.com/window....mspx?mfr=true

User rights
http://technet2.microsoft.com/window....mspx?mfr=true

--
Gistcheckin


"Sam" wrote:

> I implemented your solution and it allowed a standard user to download and
> install files like i wanted.
>
> However, it also allowed the standard user to change the Parental Controls,
> like I did NOT want.
>
> Is there any way do enable a policy that does exactly what i requested?
> Basically, I need to create "an administrator with limited rights"
> --
> Sam M.
> Software Quality Assurance (SQA) Engineer
>
>
>
> "Gistcheckin" wrote:
>

> > Migrating from the Power Users Group
> > The Power Users group in Windows XP was designed to enable members of the
> > group to perform system tasks, such as installing applications without
> > granting full administrator permissions. Power Users also had write access to
> > areas of the file system and registry that normally only allow administrator
> > access. Power Users enabled some level of application compatibility;
> > unfortunately, this did not address a fundamental problem: applications
> > requiring unnecessary privileges and user rights. UAC does not leverage the
> > Power Users group, and the permissions granted to the Power Users group on
> > Windows XP have been removed from Windows Vista. UAC enables standard users
> > to perform all common configuration tasks. The Power Users group, however, is
> > still available for backwards compatibility with other versions of Windows.
> > To use the Power Users group on Windows Vista, a new security template must
> > be applied to change the default permissions on system folders and the
> > registry to grant Power Users group permissions equivalent to Windows XP.
> >
> > To disable UAC from prompting for credentials to install applications
> >
> > 1. Click Start, click All Programs, click Accessories, click Run, type
> > secpol.msc in the Open text box, and then click OK.
> >
> > 2. From the Local Security Settings console tree, click Local Policies, and
> > then Security Options.
> >
> > 3. Scroll down and double-click User Account Control: Detect application
> > installations and prompt for elevation.
> >
> > 4. From the User Account Control: Detect application installations and
> > prompt for elevation Properties dialog box, click Disabled, and then click OK.
> >
> > 5. Close the Local Security Settings window.
> >
> >
> > To change the elevation prompt behavior
> >
> > 1. Click Start, click Accessories, click Run, type secpol.msc in the Open
> > text box, and then click OK.
> >
> > 2. From the Local Security Settings console tree, click Local Policies, and
> > then Security Options.
> >
> > 3. Scroll down to and double-click User Account Control: Behavior of the
> > elevation prompt for administrators or User Account Control: Behavior of the
> > elevation prompt for standard users.
> >
> > 4. From the drop-down menu, select one of the following settings:
> >
> > • No prompt
> >
> > • Prompt for credentials (this setting requires user name and password input
> > before an application or task will run as elevated, and is the default for
> > standard users)
> >
> > • Prompt for consent (this is the default setting for administrators only)
> >
> >
> > 5. Click OK.
> >
> > 6. Close the Local Security Settings window.
> >
> >
> > http://technet2.microsoft.com/Window....mspx?mfr=true
> >
> >
> >
> > --
> > Gistcheckin
> >
> >
> > "Sam" wrote:
> >

> > > I looked at the two URLS that you offered me and I didn't see anything that
> > > told me clearly and specifically what to do to accomplish what I want to do.
> > > I have a home network with no Active Directory Domain.
> > >
> > > Maybe I am slow, but I posed specific authorizations and/or polices that I
> > > wanted in place and I didn't see anything that showed my how to created a
> > > user that could download files, install programs and change his password -
> > > yet NOT be about to change other peoples passwords and change and/or remove
> > > the parental controls.
> > >
> > > Can you please break it down to the basic steps?
> > > What happened to the concept of the Power Users group?
> > >
> > > Still stumped...
> > > Sam
> > > Software Quality Assurance (SQA) Engineer
> > >
> > >
> > >
> > > "Ronnie Vernon MVP" wrote:
> > >
> > > > Sam
> > > >
> > > > With Vista Ultimate you have the resources provided by the Group Policy
> > > > (gpedit.msc) and the Security Policy (SecPol.msc) components.
> > > >
> > > > These tools can accomplish just about anything you need to open or lock down
> > > > any component in the system. It may take you a short time to learn, but it
> > > > is well worth the effort.
> > > >
> > > > Resources for Learning About Group Policy for Windows Vista:
> > > > http://technet2.microsoft.com/Window...0ef971033.mspx
> > > >
> > > > Download details: Group Policy Settings Reference:
> > > > http://www.microsoft.com/downloads/d...DisplayLang=en
> > > >
> > > > --
> > > >
> > > > Ronnie Vernon
> > > > Microsoft MVP
> > > > Windows Shell/User
> > > >
> > > >
> > > > "Sam" <Sam@discussions.microsoft.com> wrote in message
> > > > news:BCF32B12-C752-42F5-A274-BC8E6F3E7963@microsoft.com...
> > > > > My goal, when I bought a new Windows Vista Ultimate computer for my son's
> > > > > 8th
> > > > > grade graduation, was to give him a tool to do his high school research
> > > > > and
> > > > > homework, at the same time controlling the time that he spent on the
> > > > > computer
> > > > > playing games. He spent too much time playing online game in middle
> > > > > school
> > > > > and his grades suffered as a result.
> > > > >
> > > > > When I configured Windows Vista Ultimate, I setup myself as the Vista
> > > > > Administrator and set him up as a Vista Standard User. Then I enabled
> > > > > Parental Controls and set computer usage time limits.
> > > > >
> > > > > However, as a Windows Vista Ultimate Standard User, he cannot download
> > > > > research or other files from the internet and/or he cannot install any
> > > > > programs (educational or not).
> > > > >
> > > > > The bottom line is that I want give him all the rights of a Windows Vista
> > > > > Administrator, with the following exceptions:
> > > > > * I do not want to let him remove or modify the Parental Controls in any
> > > > > way
> > > > > * I do not want to let him change his own or other peoples privileges.
> > > > > * I do not want him to change other user's, like his sister, password,
> > > > > but
> > > > > he should be able to change his own password.
> > > > > * I do not want him to change the Windows Live OneCare firewall and other
> > > > > settings. Windows Live OneCare should block him from downloading and
> > > > > installing spyware or viruses.
> > > > >
> > > > > Can someone please tell me how to enable this in Windows Vista Ultimate?
> > > > >
> > > > > Thanks,
> > > > >
> > > > > Sam
> > > > > Software Quality Assurance (SQA) Engineer
> > > > >
> > > >

Yes, but which is the user rights policy that states you can not change
Parental Controls?

I did not see the words, "Parental Controls" in either of the links that you
provided.

I'm beginning to think that Windows Vista Utimate is not the answer to my
wishes.
I don't think that Net Nanny, from what i read, is the answer either. If my
kids can elevate themselves to administrators, they can turn off Parental
Controls or disable Net Nanny.

I can set time limits on my Linksys router but not on a per user basis -
everyone would be affected by router time limits.

--
Sam M.
Software Quality Assurance (SQA) Engineer


"Gistcheckin" wrote:

> I believe you can restrict the User's Rights
> http://technet2.microsoft.com/window....mspx?mfr=true
>
> User rights
> http://technet2.microsoft.com/window....mspx?mfr=true
>
> --
> Gistcheckin
>
>
> "Sam" wrote:
>

> > I implemented your solution and it allowed a standard user to download and
> > install files like i wanted.
> >
> > However, it also allowed the standard user to change the Parental Controls,
> > like I did NOT want.
> >
> > Is there any way do enable a policy that does exactly what i requested?
> > Basically, I need to create "an administrator with limited rights"
> > --
> > Sam M.
> > Software Quality Assurance (SQA) Engineer
> >
> >
> >
> > "Gistcheckin" wrote:
> >

> > > Migrating from the Power Users Group
> > > The Power Users group in Windows XP was designed to enable members of the
> > > group to perform system tasks, such as installing applications without
> > > granting full administrator permissions. Power Users also had write access to
> > > areas of the file system and registry that normally only allow administrator
> > > access. Power Users enabled some level of application compatibility;
> > > unfortunately, this did not address a fundamental problem: applications
> > > requiring unnecessary privileges and user rights. UAC does not leverage the
> > > Power Users group, and the permissions granted to the Power Users group on
> > > Windows XP have been removed from Windows Vista. UAC enables standard users
> > > to perform all common configuration tasks. The Power Users group, however, is
> > > still available for backwards compatibility with other versions of Windows.
> > > To use the Power Users group on Windows Vista, a new security template must
> > > be applied to change the default permissions on system folders and the
> > > registry to grant Power Users group permissions equivalent to Windows XP.
> > >
> > > To disable UAC from prompting for credentials to install applications
> > >
> > > 1. Click Start, click All Programs, click Accessories, click Run, type
> > > secpol.msc in the Open text box, and then click OK.
> > >
> > > 2. From the Local Security Settings console tree, click Local Policies, and
> > > then Security Options.
> > >
> > > 3. Scroll down and double-click User Account Control: Detect application
> > > installations and prompt for elevation.
> > >
> > > 4. From the User Account Control: Detect application installations and
> > > prompt for elevation Properties dialog box, click Disabled, and then click OK.
> > >
> > > 5. Close the Local Security Settings window.
> > >
> > >
> > > To change the elevation prompt behavior
> > >
> > > 1. Click Start, click Accessories, click Run, type secpol.msc in the Open
> > > text box, and then click OK.
> > >
> > > 2. From the Local Security Settings console tree, click Local Policies, and
> > > then Security Options.
> > >
> > > 3. Scroll down to and double-click User Account Control: Behavior of the
> > > elevation prompt for administrators or User Account Control: Behavior of the
> > > elevation prompt for standard users.
> > >
> > > 4. From the drop-down menu, select one of the following settings:
> > >
> > > • No prompt
> > >
> > > • Prompt for credentials (this setting requires user name and password input
> > > before an application or task will run as elevated, and is the default for
> > > standard users)
> > >
> > > • Prompt for consent (this is the default setting for administrators only)
> > >
> > >
> > > 5. Click OK.
> > >
> > > 6. Close the Local Security Settings window.
> > >
> > >
> > > http://technet2.microsoft.com/Window....mspx?mfr=true
> > >
> > >
> > >
> > > --
> > > Gistcheckin
> > >
> > >
> > > "Sam" wrote:
> > >
> > > > I looked at the two URLS that you offered me and I didn't see anything that
> > > > told me clearly and specifically what to do to accomplish what I want to do.
> > > > I have a home network with no Active Directory Domain.
> > > >
> > > > Maybe I am slow, but I posed specific authorizations and/or polices that I
> > > > wanted in place and I didn't see anything that showed my how to created a
> > > > user that could download files, install programs and change his password -
> > > > yet NOT be about to change other peoples passwords and change and/or remove
> > > > the parental controls.
> > > >
> > > > Can you please break it down to the basic steps?
> > > > What happened to the concept of the Power Users group?
> > > >
> > > > Still stumped...
> > > > Sam
> > > > Software Quality Assurance (SQA) Engineer
> > > >
> > > >
> > > >
> > > > "Ronnie Vernon MVP" wrote:
> > > >
> > > > > Sam
> > > > >
> > > > > With Vista Ultimate you have the resources provided by the Group Policy
> > > > > (gpedit.msc) and the Security Policy (SecPol.msc) components.
> > > > >
> > > > > These tools can accomplish just about anything you need to open or lock down
> > > > > any component in the system. It may take you a short time to learn, but it
> > > > > is well worth the effort.
> > > > >
> > > > > Resources for Learning About Group Policy for Windows Vista:
> > > > > http://technet2.microsoft.com/Window...0ef971033.mspx
> > > > >
> > > > > Download details: Group Policy Settings Reference:
> > > > > http://www.microsoft.com/downloads/d...DisplayLang=en
> > > > >
> > > > > --
> > > > >
> > > > > Ronnie Vernon
> > > > > Microsoft MVP
> > > > > Windows Shell/User
> > > > >
> > > > >
> > > > > "Sam" <Sam@discussions.microsoft.com> wrote in message
> > > > > news:BCF32B12-C752-42F5-A274-BC8E6F3E7963@microsoft.com...
> > > > > > My goal, when I bought a new Windows Vista Ultimate computer for my son's
> > > > > > 8th
> > > > > > grade graduation, was to give him a tool to do his high school research
> > > > > > and
> > > > > > homework, at the same time controlling the time that he spent on the
> > > > > > computer
> > > > > > playing games. He spent too much time playing online game in middle
> > > > > > school
> > > > > > and his grades suffered as a result.
> > > > > >
> > > > > > When I configured Windows Vista Ultimate, I setup myself as the Vista
> > > > > > Administrator and set him up as a Vista Standard User. Then I enabled
> > > > > > Parental Controls and set computer usage time limits.
> > > > > >
> > > > > > However, as a Windows Vista Ultimate Standard User, he cannot download
> > > > > > research or other files from the internet and/or he cannot install any
> > > > > > programs (educational or not).
> > > > > >
> > > > > > The bottom line is that I want give him all the rights of a Windows Vista
> > > > > > Administrator, with the following exceptions:
> > > > > > * I do not want to let him remove or modify the Parental Controls in any
> > > > > > way
> > > > > > * I do not want to let him change his own or other peoples privileges.
> > > > > > * I do not want him to change other user's, like his sister, password,
> > > > > > but
> > > > > > he should be able to change his own password.
> > > > > > * I do not want him to change the Windows Live OneCare firewall and other
> > > > > > settings. Windows Live OneCare should block him from downloading and
> > > > > > installing spyware or viruses.
> > > > > >
> > > > > > Can someone please tell me how to enable this in Windows Vista Ultimate?
> > > > > >
> > > > > > Thanks,
> > > > > >
> > > > > > Sam
> > > > > > Software Quality Assurance (SQA) Engineer
> > > > > >
> > > > >