1

Is it possible in Windows to create a "semi-admin" account? For example, is it possible to create an additional administrator account with the only limiting factor being that it is lower in the permission hierarchy than the original admin account (i.e. it cannot kill any processes started by the original admin account nor take ownership of it's files, etc.)

I am failing to find any talk of this on the internet and having trouble doing this myself.

This should work in theory. If Windows NT supports something like this for Servers then surely it should be doable for a regular Windows 7 non enterprise edition as well?

Thanks in advance

DTS

  • My aim though is to have two admins, both with the same permissions, just that one is above the other meaning the lower one cannot delete files and kill processes created by the higher one. Is this definitely possible? Are there 3rd party programs even that uncover this functionality (because in theory it should work)? Thanks. – DST Dec 10 '16 at 19:13
  • So how do Windows Server editions implement administrator hierarchies? I understand they use Active Directory but does that not mean that it is actually written into the Windows NT Kernel? Thanks. – DST Dec 10 '16 at 19:30
2

TL;DR:

Permissions themselves are not hierarchical in Windows so you can't assign a right based on the 'level' of a user. They are individual permissions that are assigned to a resource for each user. A Venn diagram is a good analogy - if a user falls into the right circle he/she can perform the associated action.

In More Detail

In Windows, each resource (file, process, registry entry, etc.) has an Access Control List (ACL) with one or more entries that defines which users have which permission on the resource. Furthermore, you can (and should) assign the permission to a group and add the user to the group.

An administrator is simply a user who belongs to a group (Administrators) which by default has all permissions on all resources (well, most actually, but that's another post).

There are other default groups which have a subset of those permissions which might fit your requirement:

Local groups: https://technet.microsoft.com/en-us/library/cc771990(v=ws.11).aspx

Active Directory groups: https://technet.microsoft.com/en-us/library/dn579255(v=ws.11).aspx

You can also create your own groups that have a subset of the permissions assigned to a subset of the resources: https://technet.microsoft.com/en-us/library/cc754344(v=ws.11).aspx

There are many nuances to setting permissions so that they (1) have the intended effect, and (2) are maintainable and I strongly recommend reading some best practices before getting too far into it, but some general pointers for NTFS permissions are:

  • add users to groups and assign permissions to the group (not to the user!)
  • use nested groups for better organization, for example U:BSmith -> G:Accounting -> G:PayrollUsers -> ACL
  • give groups the least privilege they need to do the job defined by the group
  • Permissions are additive. I.e. if a user belongs to two different groups they will be allowed to do anything either group can do.
  • Deny permissions override allow permissions. I.e. if a user belongs to two different groups they will be allowed everything either group can do, minus anything either group is specifically denied.

If you are doing anything mission critical I would strongly recommend getting someone with experience to help you. There are many ways to cause unintended side effects.

  • I was scared that this was the answer. Thanks anyway! – DST Dec 10 '16 at 19:48

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.