User Accounts in Vista Home Premium?

On Fri, 19 Oct 2007 19:04:12 -0700, Ronnie Vernon MVP wrote:

> Just like the XP Home versions, the Vista Home versions do not
> include the management console snap-ins like local users and
> groups.

The Event Viewer seems to be a MC snap-in, available in
Home-Premium.

--
Chris Game

"Hopefully the net-dwelling paranoid delusional conspiracy theorists
won't descend upon me " -- Chris Pratley, MSFT.

Chris

That's correct. The only snap-ins that are not included are things like
Group Policy, Security Policy, etc. These components are focused on managing
large numbers of systems and large groups of users, which is not usually
important to the home version users.

--

Ronnie Vernon
Microsoft MVP
Windows Shell/User


"Chris Game" <chrisgame@example.net> wrote in message
news:1a6b4r11ijcaj$.dlg@example9876.com...

> On Fri, 19 Oct 2007 19:04:12 -0700, Ronnie Vernon MVP wrote:
>

>> Just like the XP Home versions, the Vista Home versions do not
>> include the management console snap-ins like local users and
>> groups.

>
> The Event Viewer seems to be a MC snap-in, available in
> Home-Premium.
>
> --
> Chris Game
>
> "Hopefully the net-dwelling paranoid delusional conspiracy theorists
> won't descend upon me " -- Chris Pratley, MSFT.

Thank you, Ronnie, see in-line replies below:

"Ronnie Vernon MVP" <rv@invalid.org> wrote in message
news:F9BDAA53-C51B-4DCD-AB83-8857DB928B40@microsoft.com...

> Blue Max
>
> Just like the XP Home versions, the Vista Home versions do not include the
> management console snap-ins like local users and groups.

I was afraid this might be the case. Thank you for the confirmation.

> Most everything that you can do with the MMC can be done in the home
> versions using direct registry edits.

This is good go know, a little more technical than I might have wanted, but
a useful possibility.

> There is no way to actually 'disable' an account in Vista, but you can
> 'hide' an account so that it is invisible on the login screen.

Interesting, because my Vista property dialogs for each user have an option
titled "Account is disabled" versus "Account is hidden." Nevertheless, I
think I understand what you are describing. In Windows XP the
'Administrator' account was not displayed on the 'Welcome' screen, but could
still be accessed remotely or at the 'Welcome' screen using Ctrl-Alt-Del.
Is this the same behavior we should expect in Vista? In other words, the
account is hidden, but still active?

If so, how do we access the Administrator account, for example, from the
'Welcome' screen as we did in Windows XP? And now back to our concern in
our original message, how would one ever 'Unhide' or 'Enable' the
Administrator account in Vista Home Premium, which is hidden or disabled by
default, but has no snap-in? Are we going to be forced into the registry to
change a default or is there a utility like TWEAKUI that will help with
these changes?

Thank you for the help.

> Let me know if this is what you want to do.
>
> --
>
> Ronnie Vernon
> Microsoft MVP
> Windows Shell/User
>
>
> "Blue Max" <mailrichard@msn.com> wrote in message
> news:B0AB9C15-7F6F-49CD-A59D-CD44C5373B00@microsoft.com...

>>I am working on a laptop computer running Microsoft Vista Home Premium. I
>>wanted to access the utility for modifying user account permissions;
>>normally found in the 'Local Users and Groups' dialog within the Windows
>>Computer Management utility (right-click Computer icon and select Manage).
>>However, I cannot find any 'Local Users and Groups' option in Vista Home
>>Premium. Without this feature how can we enable or disable user accounts
>>or profiles?
>>

>

Blue Max

Sorry for the long delay, I had to deal with the CA wildfires this past
week.

> Interesting, because my Vista property dialogs for each user have an
> option titled "Account is disabled" versus "Account is hidden."
> Nevertheless, I think I understand what you are describing. In Windows XP
> the 'Administrator' account was not displayed on the 'Welcome' screen, but
> could still be accessed remotely or at the 'Welcome' screen using
> Ctrl-Alt-Del. Is this the same behavior we should expect in Vista? In
> other words, the account is hidden, but still active?

Actually, you can 'disable' an account in Vista, either by using the option
you describe or from a command line. Unfortunately, the resulting behavior
has been changed in Vista. If you disable a user account, that account will
no longer be available, anywhere. The CTRL+ALT+DEL behavior has changed in
Vista. You can no longer use this keyboard combination to bring up the old
style login dialog. If you disable or hide a user account, that account will
no longer appear even in Safe Mode. As a result, you must be very careful
when disabling or hiding any user account.

>
> If so, how do we access the Administrator account, for example, from the
> 'Welcome' screen as we did in Windows XP? And now back to our concern in
> our original message, how would one ever 'Unhide' or 'Enable' the
> Administrator account in Vista Home Premium, which is hidden or disabled
> by default, but has no snap-in? Are we going to be forced into the
> registry to change a default or is there a utility like TWEAKUI that will
> help with these changes?

The only way to access the built-in Administrator account is to enable the
account from within Vista. You can do this from an elevated command line.
Start cmd.exe with administrator privileges and type the following.

net user administrator /active:yes

Press Enter.

To disable the account, change the 'yes' to 'no'.

You can use this command to enable or disable any user account.

You can also use a registry edit, in the Home versions of Vista, to force
the old style login dialog box to appear. If you do enable this, the login
dialog will appear everytime you boot and no user accounts will be visible.

--

Ronnie Vernon
Microsoft MVP
Windows Shell/User


"Blue Max" <mailrichard@msn.com> wrote in message
news:C0A55E0A-4590-46FC-8A27-AC043187E19E@microsoft.com...

> Thank you, Ronnie, see in-line replies below:
>
> "Ronnie Vernon MVP" <rv@invalid.org> wrote in message
> news:F9BDAA53-C51B-4DCD-AB83-8857DB928B40@microsoft.com...

>> Blue Max
>>
>> Just like the XP Home versions, the Vista Home versions do not include
>> the management console snap-ins like local users and groups.

>
> I was afraid this might be the case. Thank you for the confirmation.
>

>> Most everything that you can do with the MMC can be done in the home
>> versions using direct registry edits.

>
> This is good go know, a little more technical than I might have wanted,
> but a useful possibility.
>

>> There is no way to actually 'disable' an account in Vista, but you can
>> 'hide' an account so that it is invisible on the login screen.

>
>
> Thank you for the help.
>

>> Let me know if this is what you want to do.
>>
>> --
>>
>> Ronnie Vernon
>> Microsoft MVP
>> Windows Shell/User
>>
>>
>> "Blue Max" <mailrichard@msn.com> wrote in message
>> news:B0AB9C15-7F6F-49CD-A59D-CD44C5373B00@microsoft.com...

>>>I am working on a laptop computer running Microsoft Vista Home Premium.
>>>I wanted to access the utility for modifying user account permissions;
>>>normally found in the 'Local Users and Groups' dialog within the Windows
>>>Computer Management utility (right-click Computer icon and select
>>>Manage). However, I cannot find any 'Local Users and Groups' option in
>>>Vista Home Premium. Without this feature how can we enable or disable
>>>user accounts or profiles?
>>>

>>

>

> Actually, you can 'disable' an account in Vista, either by using the

> option you describe or from a command line. Unfortunately, the resulting
> behavior has been changed in Vista. If you disable a user account, that
> account will no longer be available, anywhere. The CTRL+ALT+DEL behavior
> has changed in Vista. You can no longer use this keyboard combination to
> bring up the old style login dialog. If you disable or hide a user
> account, that account will no longer appear even in Safe Mode. As a
> result, you must be very careful when disabling or hiding any user
> account.

This is pretty scary stuff! Why didn't they build in a feature that would
prevent the user from hiding or disabling the only remaining administrator
account? It doesn't take a psyhic to foresee that there are going to be
some really angry users down the road who fall prey to this oversight;
potientially at great cost to themselves or their business entity.

Blue Max

I do understand what you are saying and your concerns.

Users will get in trouble if they assume that Vista will work the same way
that XP or other previous versions of Windows worked.

Most of the changes in behavior for Vista are a result of the new security
model. In XP it was very easy for anyone to sit down at your computer,
reboot to safe mode and log in with the built-in administrator account. Most
people did not take the time to follow the recommendations to change the
name and assign a strong password to this account.

Here are some notes that I kept when I was testing this new hidden, disabled
user accounts behavior in Vista.

NOTES ON HIDING AND DISABLING ACCOUNTS IN VISTA

If all user created administrator accounts are 'hidden' and the Built-In
Administrator account is 'disabled', a standard account will not be able to
elevate any function, even in Safe Mode.

You can use the old style login dialog to log on to a 'hidden' account in
normal or safe mode.

You cannot use the old style login dialog to log on with a 'disabled'
account in normal or safe mode.

You cannot use this old style dialog to log onto the built-in admin account
in safe mode if it is disabled (default) when a user created administrator
account is present, even if the user created account is hidden.

If any account is 'hidden', it will not be visible on the login screen, even
in Safe Mode. The only way to log on with a 'hidden' account is if you have
the old style login dialog enabled.

If the only user created administrator account is 'hidden', the built-in
administrator account will not appear on the login screen in Safe Mode.

If the only user created administrator account is 'disabled' the built-in
administrator account will appear in safe mode.

If the only user created administrator account has been corrupted or deleted
the built-in administrator account will appear in safe mode.

The CTRL+ALT+DEL keyboard combination no longer works the way it did in
previous versions of windows. It is now used to provide a 'Trusted Path' in
Vista to prevent malicious prgrams from intercepting a users logon
credentials. It will 'not' bring up the old style login dialog at the
welcome screen in normal or safe mode.

If you want to hide user accounts, the safest way is to enable the old style
logon dialog when you hide the accounts. This must be done using the Group
Policy Editor (Business, Enterprise, Ultimate) or in the registry (Home
Basic, Home Premium). This will still give you access to those hidden
accounts, without making them visible.

--

Ronnie Vernon
Microsoft MVP
Windows Shell/User


"Blue Max" <mailrichard@msn.com> wrote in message
news:E2157E8A-28DF-43EB-BCCB-D390A170B719@microsoft.com...

>> Actually, you can 'disable' an account in Vista, either by using the
>> option you describe or from a command line. Unfortunately, the resulting
>> behavior has been changed in Vista. If you disable a user account, that
>> account will no longer be available, anywhere. The CTRL+ALT+DEL behavior
>> has changed in Vista. You can no longer use this keyboard combination to
>> bring up the old style login dialog. If you disable or hide a user
>> account, that account will no longer appear even in Safe Mode. As a
>> result, you must be very careful when disabling or hiding any user
>> account.

>
> This is pretty scary stuff! Why didn't they build in a feature that would
> prevent the user from hiding or disabling the only remaining administrator
> account? It doesn't take a psyhic to foresee that there are going to be
> some really angry users down the road who fall prey to this oversight;
> potientially at great cost to themselves or their business entity.

On Tue, 30 Oct 2007 12:16:29 -0700, Ronnie Vernon MVP wrote:

> If you disable or hide a user account, that account will no longer
> appear even in Safe Mode. As a result, you must be very careful
> when disabling or hiding any user account.

I thought the Administrator account enabled itself in Safe Mode if
other admin accounts were removed?

--
Chris Game

"Not everything that can be counted counts, and not everything
that counts can be counted." - Albert Einstein

"Chris Game" <chrisgame@example.net> wrote in message
newsqhn4bx9y0by.dlg@example9876.com...

> I thought the Administrator account enabled itself in Safe Mode if
> other admin accounts were removed?

Chris

This was the default behavior in previous versions of windows such as XP but
it works differently in Vista.

The key word here is 'removed'. If you remove all of the user created
administrator accounts, then the Built-In Administrator account will appear
on the Safe Mode login screen. This is the safety net in case all
administrator accounts have been deleted, corrupted or removed.

However, if a user created administrator account has been hidden, Vista will
still detect that account and the built-in administrator account will not
appear on the safe mode login screen.

I don't recommend hiding any accounts in Vista. If you don't want the
accounts appearing on the login screen, you can simply enable the old style
login dialog where you have to enter a user name and password. This works
even if an account has been hidden.

The bottom line here is that you don't want to assume that because something
worked in XP that it will still work the same way in Vista.
--

Ronnie Vernon
Microsoft MVP
Windows Shell/User