I'd like to know what are the best practices for creating a limited user account in a Windows 7 system, much like the user environment in Linux, where you have the superuser and the other normal users. Ultimately I'd like the normal Windows user to be restricted to touch anything on the partition where the Windows install is (this includes the WIN folders, Program Files, etc), to be locked only in something like a home folder and permissions to be required for everything that is more advanced (installation, configuration, etc).
To further elaborate on my comment, your question leaves me somewhat confused as I assumed, what your're asking to be fact with Windows 7.
In Windows 7 the Administrator account (equivalent to root on Linux) is not available for direct use by default. So usually you have an account with administrative privileges (equivalent to being in
Normal users will not be able to perform any administrative actions. Additionally, you can control access rights on the file system for every user account or user group, just as you would on Linux.
Regarding your wish to secure privilege elevation with a password. To my knowledge that is not possible (by design). As you may know, on Linux systems, your privilege elevation authorization is cached for a while. So if you use
Of course there can be times where your credentials are requested again. Like when you access resources over the network or when logging into certain services (SharePoint, SQL Server, ...) but that is to be expected.
Also, please note that there is a command line utility in Windows which is equivalent to
Left in it's default configuration, running an account with USER permissions on Windows 7 will have essentially the effect you're describing, gmunk.
User Access Control (UAC) and the default rights of a USER account set account permissions more or less exactly as you describe. No special configuration necessary.
It depends. As always.
Depending on what you're doing with the computer your security requirements will change.