I have a co-worker who is set up as an admin user under Win XP SP3 and I'm trying to switch her to being a restricted user. The short story is that when I switch her account to restricted, Chrome can't make HTTPS connections and Outlook can't connect to our Office 365 Exchange server. Firefox can make HTTPS connections with no problem.
Some things I've tried
- Append ":443" to the HTTPS URL in Chrome
- Reset browser settings in Chrome
- Deleted Local Settings\Application Data\Google\Chrome\User Data\Certificate Revocation Lists
- Changed the account to the Power Users group
Some background
When I first changed her account to restricted she couldn't access any files in her home directory. This turned out to be because her home directory was owned by the Administrators group, not by her user account. I switched the ownership to her home account and she was able to access the files.
After that, even though she could access her files, she couldn't do things like make changes to her desktop or access the Recycle Bin settings. This turned out to be because her HKEY_CURRENT_USER keys were also owned by the Administrators group.
A potentially helpful error message
When Outlook starts up after her account has been switched to restricted, it gives this error message:
autodiscover-s.outlook.com
Information you exchange with this site cannot be viewed or changed by others. However, there is a problem with the site's security certificate.
The application experienced an internal error loading the SSL libraries.
This site should not be trusted
So apparently there's something in the way that Google and Outlook (but not Firefox) handle HTTPS/SSL that gets broken when she doesn't have access to something somewhere. I imagine it's another thing that is owned by the Administrators group instead of her account. I just can't figure out what and where that something is.
Windows Certificate Store
? Chrome and Outlook uses the` Windows Certificate Store`. Firefox handles its own certificates.