What are the differences between limited accounts and computer administrators in XP?

Question

I'm looking for particular examples of what can and can't be done by a limited account rather than vague generalisations. For example, run batch files/scripts but what commands can't be used? What areas of the registry can be touched (if any)? What directories are off-limits by default (if any)?

Answer 1

See these articles from Microsoft:

• Limited User accounts can protect your Windows XP computer when you browse the Web.
• Types of user accounts.

In terms of the file system, generally speaking, limited accounts can't write to most locations outside of their profile folder. e.g. the Windows folder and Program Files are off-limits.

In terms of the registry, generally speaking, limited accounts can't modify HKEY_LOCAL_MACHINE, only HKEY_CURRENT_USER.

Answer 2

Not that many;

A limited account cannot touch anything that affects other users on the computer. This means no access to c:\windows, no access to other user directories, no systemwide settings changes (though any per-user settings are good-to-go)

Limited accounts also can't install some programs (specifically ones that must integrate with the system to function - again going back to the affecting others point), but most of the time can install to their own directory without issue (Fun Fact: Google Chrome installs to a local dir, so limited users can install it without even a single extra step)

As for batch files, likely 99% of commands can be used, but what they can do is limited, again to a local view.

Of course, there will be some things limited accounts can do to affect others, but in general they shouldn't be - and neither can anything hidden inside them, like Virus.exe :)

Answer 3

Let's group those common non-administrator user accounts.

• Power Users
• Users
• Guests

Nothing beats what Microsoft site says. See it here.

For more details of guest account, check this out.