Duplicating Linux-like user account permissions in Windows 7

Question

I'd like to know what are the best practices for creating a limited user account in a Windows 7 system, much like the user environment in Linux, where you have the superuser and the other normal users. Ultimately I'd like the normal Windows user to be restricted to touch anything on the partition where the Windows install is (this includes the WIN folders, Program Files, etc), to be locked only in something like a home folder and permissions to be required for everything that is more advanced (installation, configuration, etc).

Answer 1

To further elaborate on my comment, your question leaves me somewhat confused as I assumed, what your're asking to be fact with Windows 7.

In Windows 7 the Administrator account (equivalent to root on Linux) is not available for direct use by default. So usually you have an account with administrative privileges (equivalent to being in /etc/sudoers). That user can perform tasks as the Administrator by confirming a UAC prompt.

Normal users will not be able to perform any administrative actions. Additionally, you can control access rights on the file system for every user account or user group, just as you would on Linux.

Regarding your wish to secure privilege elevation with a password. To my knowledge that is not possible (by design). As you may know, on Linux systems, your privilege elevation authorization is cached for a while. So if you use sudo and authorize yourself, if you use sudo again a few seconds later, you don't need to enter your password again.
On Windows, that's not the case. You have to confirm that prompt every. single. time.
So it's already annoying as hell (also by design). I guess the Windows architects decided against requesting a password. The only time you have to provide your credentials is when you log into your account. The Windows architects decided that to be enough.

Of course there can be times where your credentials are requested again. Like when you access resources over the network or when logging into certain services (SharePoint, SQL Server, ...) but that is to be expected.

Also, please note that there is a command line utility in Windows which is equivalent to sudo called runas which might be of interest to you (I, personally, hardly ever use it).

Answer 2

Left in it's default configuration, running an account with USER permissions on Windows 7 will have essentially the effect you're describing, gmunk.

User Access Control (UAC) and the default rights of a USER account set account permissions more or less exactly as you describe. No special configuration necessary.

UPDATE:

It depends. As always.

Depending on what you're doing with the computer your security requirements will change.

• Is this a home computer that will be the only computer in the house? Add some antivirus software and you're pretty much OK.
• Is this a corporate workstation? If the corporate network is secured properly, the security of individual workstations within the network is less important and is usually turned down a little to enable communication with the rest of the network.
• Is this a desktop that will not move and will always be connected to the same network? Probably somewhere between the corporate setup and the single-computer home setup. You'll want to be able to share printers and maybe files and media between the computers, so you'll want to make sure they trust each other but don't accept communication from non-trusted computers as well as more robust antivirus.
• Is this a laptop that will be traveling? You'll want really, really strong security. A local firewall installed on the computer (the Windows firewall is OK, you may prefer something else though) and good antivirus software.
• Does the user need to be able to install stuff? Probably not based on your question.