Wicked00

I activated the guest account, but the guest account still lets me do just about everything as the Administrator account. I was hoping it would be very limited in options. Is there something I have to check off, or turn on? Where can I adjust each user's rights?

Lonman

If you're not in the habit of having 'guests' use your computer, just disable the account.

If you're running an NTFS volume, then you can further define user restrictions by Opening Windows Explorer> Tools> Folder Options> 'view' tab. Go in and untick 'simple file sharing.'

Then you can right click on a drive/folder/file> Sharing and Security> 'security' tab, and set your restrictions accordingly for eash user account/group.

chooch

You can also set the restriction of the account within the Local Security setting in the Administrative tools in Control Panel. Click on Security Settings\Local Policies\User Rights Assignment. In there you could specify what exactly is it that you would like to allow the Guest account to do, also you might want to check and make sure the guest account is only part of the guest account group from within Computer Managment or vial the User Account in Control Panel, click on the Guest Account, click on change my account type and make sure it is set to limited.

Druce

go to start - run - type "lusrmgr.msc" (without quotes) - then you can edit what groups and permissions each account has.. this a bit more powerful than the gui interface thru the admin tools

hope this helps

chooch

lusrmgr.msc is a snap-in that is already added to the Computer Management console

Druce

doh! i knew that too... now i feel dumb.. lol

yea, he's right... listen to him... all the icon in the control panel is - is a shortcut to the snap in...

boy i feel stooopid now....

chooch

Druce,

That was just an FYI not to make anyone feel stupid, i apologize if i did.

Druce

naa, i am just a silly person...

thanks for keeping me honest.. lol

Wicked00

I'd like the guest account to only have access to the internet and that's it. Nothing else. My brother uses my computer and he somehow always manages to delete some files that I need, so how can I go about either making a name, or using the guest account to only have rights to view websites?

Druce

i can look this up when i get home and give you an answer... hope you can wait till monday night

Wicked00

Not a problem Thanks for trying to help

Wicked00

Druce, did you by any chance find anything out?

Druce

A user right is authorization to perform an operation that affects an entire computer. (A permission, by contrast, is authorization to perform an operation on a specific object—such as a file or a printer—on a computer.)For each user right, you can specify which user accounts and groups have the user right. To review or set user rights, in Group Policy (Gpedit.msc) navigate to Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment. Then double-click a user right to view or change the list of users and groups.

To review or change the local setting for a user right, double-click the user right in User Rights Assignment.
tip - Use the Local Security Settings console
--------------------------------------------------------------------------------
The Local Security Settings console provides a shorter path to User Rights Assignment, so it’s useful when you’re not setting other policies, such as the ones in the Administrative Templates folders. To open Local Security Settings, double-click Local Security Policy in the Administrative Tools folder or type secpol.msc at a command prompt.

Ten of the user rights—Access This Computer From The Network, Allow Logon Through Terminal Services, Log On As A Batch Job, Log On As A Service, Log On Locally, and their corresponding "Deny" user rights—are known more precisely as logon rights. They control how users are allowed to access the computer—whether from the keyboard ("locally") or through a network connection, or whether as a service or as a batch facility (such as Task Scheduler). You can use these logon rights (in particular, Log On Locally and Deny Logon Locally) to control who can log on to your computer. By default, Log On Locally is granted to the local Guest account and members of the Administrators, Backup Operators, Power Users, and Users groups. If you want to prevent certain users from logging on at the keyboard (but still allow them to connect via the network, for example), create a group, add those user accounts to it, and then assign the Deny Logon Locally user right to the new group. Like deny permissions, deny logon rights take precedence over allow logon rights, so if a user is a member of a group that is allowed to log on (such as Power Users) and a group that is not (such as the one described in the previous sentence), the user will not be allowed to log on. (Such users are rebuffed with an error message after they type their user name and password in the Log On To Windows dialog box.)

hope this will shed a little light on it all

DAZZ

umm i dont really get what ur saying, i have the same problem, but not getting what u guys are saying