Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'd like to know what are the best practices for creating a limited user account in a Windows 7 system, much like the user environment in Linux, where you have the superuser and the other normal users. Ultimately I'd like the normal Windows user to be restricted to touch anything on the partition where the Windows install is (this includes the WIN folders, Program Files, etc), to be locked only in something like a home folder and permissions to be required for everything that is more advanced (installation, configuration, etc).

share|improve this question
5  
Correct me if I'm wrong, but shouldn't this be the default behavior for any current version of Windows? –  Oliver Salzburg Feb 9 '12 at 20:27
    
@gmunk Have you not tried to move or delete stuff you shouldn't have permissions for? –  Daniel Beck Feb 9 '12 at 20:32
add comment

2 Answers 2

up vote 2 down vote accepted

To further elaborate on my comment, your question leaves me somewhat confused as I assumed, what your're asking to be fact with Windows 7.

In Windows 7 the Administrator account (equivalent to root on Linux) is not available for direct use by default. So usually you have an account with administrative privileges (equivalent to being in /etc/sudoers). That user can perform tasks as the Administrator by confirming a UAC prompt.

Normal users will not be able to perform any administrative actions. Additionally, you can control access rights on the file system for every user account or user group, just as you would on Linux. A dialog showing permissions in Windows 7

Regarding your wish to secure privilege elevation with a password. To my knowledge that is not possible (by design). As you may know, on Linux systems, your privilege elevation authorization is cached for a while. So if you use sudo and authorize yourself, if you use sudo again a few seconds later, you don't need to enter your password again.
On Windows, that's not the case. You have to confirm that prompt every. single. time.
So it's already annoying as hell (also by design). I guess the Windows architects decided against requesting a password. The only time you have to provide your credentials is when you log into your account. The Windows architects decided that to be enough.

Of course there can be times where your credentials are requested again. Like when you access resources over the network or when logging into certain services (SharePoint, SQL Server, ...) but that is to be expected.

Also, please note that there is a command line utility in Windows which is equivalent to sudo called runas which might be of interest to you (I, personally, hardly ever use it).

share|improve this answer
    
thank you for the nice explanation, I am quite novice to the whole thing, you are talking about confirming a prompt, I want in this prompt to be a password, also I'd like to restrict the access rights for the file system but you already provided a nice graphic explanation to how to do that! –  gmunk Feb 9 '12 at 20:40
    
I'll add more information to my answer. Hope it helps. –  Oliver Salzburg Feb 9 '12 at 20:42
    
@gmunk You can get your requirement of always requiring a password by having the user is not in the Administrators Group and only in the Users group. You will need to provide a username and password of a account in the administrator's group every time you want to do a restricted action. –  Scott Chamberlain Feb 10 '12 at 2:53
add comment

Left in it's default configuration, running an account with USER permissions on Windows 7 will have essentially the effect you're describing, gmunk.

User Access Control (UAC) and the default rights of a USER account set account permissions more or less exactly as you describe. No special configuration necessary.

UPDATE:

It depends. As always.

Depending on what you're doing with the computer your security requirements will change.

  • Is this a home computer that will be the only computer in the house? Add some antivirus software and you're pretty much OK.
  • Is this a corporate workstation? If the corporate network is secured properly, the security of individual workstations within the network is less important and is usually turned down a little to enable communication with the rest of the network.
  • Is this a desktop that will not move and will always be connected to the same network? Probably somewhere between the corporate setup and the single-computer home setup. You'll want to be able to share printers and maybe files and media between the computers, so you'll want to make sure they trust each other but don't accept communication from non-trusted computers as well as more robust antivirus.
  • Is this a laptop that will be traveling? You'll want really, really strong security. A local firewall installed on the computer (the Windows firewall is OK, you may prefer something else though) and good antivirus software.
  • Does the user need to be able to install stuff? Probably not based on your question.
share|improve this answer
    
Ok, my bad to ask an obvious question, ok from a security standpoint is this a good enough practice or should there be more configuration in order to secure a Windows box, bare in me if the questions I ask are stupid, I tried searching but I struggle finding anything relevant. –  gmunk Feb 9 '12 at 20:37
    
No worries. Actually, in recent times, Windows has enjoyed some success in securing their systems. At hacker contests, Windows 7 patched and in default security mode has been able to give Linux real competition when it comes to security. –  music2myear Feb 9 '12 at 20:56
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.