Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am trying to figure out if having a user in the "Users" group will be enough to prevent her from install unwanted software.

The things that I don't want the user to be able to install are:

  • virus
  • malware
  • bandoo stuff
  • Internet Explorer Addons

To put you in context, I am thinking of my grandma's computer, I want her to be able to read all her email stuff and attachments, but without the hassle of needing to reinstall the whole computer every few months.

The computer will run Windows XP, with some free antivirus. It will not be part of any domain. It is just a home computer.

Linux, I have tried making her use it, but she was already accustomed to Windows and was not really an option to have her re-learn where was the shutdown button.

So, are these considerations enough to prevent her installing unwanted software? What other options come to you mind?

Thanks

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

Yes unless the user is part of the administrator's group she should not be able to install software.

That doesn't prohibit her from visiting malicious websites and getting infected but you got that covered with AV so it looks like you are good to go.

share|improve this answer
2  
Malware can still be installed inside the user's profile directory, similar to Google Chrome, for example. –  oKtosiTe Feb 15 '11 at 14:47
2  
You don't need Administrator access to be a botnet zombie. –  afrazier Feb 15 '11 at 14:51
    
Is malware installed in the user's profile directory of a low privileged user easier to remove? Will things like those impossible to stop processes get installed in this way? –  DanC Feb 15 '11 at 18:15
    
Yes, because you can generally log into a different user account and blow it away. You just have to be super-extra careful that you don't run something by accident and infect the Administrator account. –  afrazier Feb 15 '11 at 18:38
add comment

If I may be so blunt, the regular user/administrator distinction is there to protect the system, not your grand mother's data.

My father, in this respect, is your grand mother, and I set up his laptop with him having reduced privileges. This doesn't prevent him from calling me with his credit card in hand, ready to pass on sensitive information to malware authors. It also doesn't protect his personal files which are much much more important than the health of the OS.

While giving your grandmother's login reduced privileges is a good idea, it's just part of the solution. The other part is making her understand that the computer should never tell her to do anything that involves puling out a credit card (and that she should call you instead if this happens), and also give her an external hard drive and set up back ups (incremental, so that when she clicks the "your computer has 100,000 viruses" banner and kills her files, she won't overwrite a good backup).

The real threats here are not malware that mess with the system, it's malware that messes with the users' heads, and unfortunately our ancestors are so vulnerable to these attacks.

share|improve this answer
    
Thanks for your post, but the computer is just a used for web browsing and email, so there is not any data that needs to be backed up. Also, she has been explicitly forbidden to put any kind of data including credit card numbers, or whatever thing she asked for. So, yes, I am trying to protect the system, and not my Grandma or her data, since I will be the one re installing the system again and again as long as ##$@&*ware keeps poping up windows to the point that it becames unusable. –  DanC Feb 15 '11 at 18:13
1  
Then keep a image of the configured system handy and worry as little as possible about it. If Grandma breaks her system, just reimage it and run Windows Update. Have tea with Grandma while you wait. :-) –  afrazier Feb 15 '11 at 18:41
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.