Why multiple accounts?

As a user of Win98SE about to move into XP is very cautious steps, I have the following questions. I'm not computer illiterate, I can program 8 bit processors at the most basic levels, but I've missed the logic chain for these changes over the years.

Why have multiple accounts? I am the only user on my personal machine. I see the logic on the machines at work, where we have roaming accounts, and personal accounts because 30 or so different people use one machine. I can see the advantage where more than one user is on one machine. I keep hearing that even on a 1 user machine (like mine) you should have an administrator account and your regular account. I don't see or understand the advantages.

Is Vista going to have a similar setup?

On a completely different subject I keep seeing XP OS's with the label NFR. I believe it stand for Not For Resale, but I'm not too sure about that. Any other theories?

 

I'm not sure if I agree with this.

It is a common security practice to DISABLE the default administative account, and have a different user as admin. This mitigates the risk presented by bots/worms specifically looking to gain access with this account. I can't see why you would have yourself using a non-administrative account if you are the only user, unless you are really insecure about your technical abilities, and worried that you might cause damage. It would be a hassle even then, because while there is the "runas" command to allow privledge escalation, it does not do EVERYTHING you could need. (ie add local printers)

Vista relies heavily on
privledge escalation. To access ANY administrative function, you must supply administrator credentials, even when logged in as administrator... (this may have changed some since beta 2)

 

Basically I think we agree. On a single user computer just have one account, the administrative account.

The reason I asked is I have read other so called guru's stating to people, when they ask about a problem their having, that they have their user account privilages set too high. Being a minor control freak, I like having complete control over my computer as a matter of course. If I get myself into a fix I'll get myself out of it, or kill the computer trying. I'm not too proud to ask questions, but you have to jump in there to learn anything.

I think I've read elsewhere on MG that Linux has a similar concept, requiring a password before implimenting potentially dangerous changes.

 

Hi Bill,
You bring up some interesting questions. We have different user accounts for the ease of storing programs (e-mail, games, texts, etc.) in different groupings. To be honest though, I don't know if this is the result of different accounts or different partitions, since we partitioned the computer from the start. I believe the user accounts do the same thing. They make individual My Documents / My Music / My Pictures for each user. Also, they make different temporary internet files. If I were the only user on my computer, I would still keep one user name for old stuff that came off of earlier computers and one for a guest who wants to run in and pick up his/her e-mail while here.

The question that occurred to me while I was reading your post was:
if all the accounts on the computer have "administrative" rights, why does it only show one user account and the administrative one when it goes into safe mode. Is this because the other user accounts simply can't be seen, because the font is so big? Anybody know this? Or is there some other priority set?

abri

 

I prefer multiple accounts, because similarly to you Bill, I like to be in control of my machines. After I build a personal machine, I change the "Administrator" name to something like "e4t68x372vab". Then I re-create an account with the "Adminstrator" name but with "guest" account priveleges. Then, I disable that account. Next, I create an account called "game", with "user" account priveleges. All gaming activity takes place with this account. Software that needs administrator credentials to install, will be given escalation to install at that time. This account does not have "internet access" If it needs internet access, I will bump the account privelege, only until I can get the download installed, then back it goes to local access only. However, I also create an account called "net". This account is set to have a minimal set of priveleges. It is very close to a "guest" account, while at the same time providing internet access. This account won't do much of anything except browse. It can't install "push" type librarary files (DLLs) into any System directory. Any changes to the registry are minimized because there isn't sufficient privelege to do so. This is all good, except that some web sites won't run in their "best configuration" if you block their "push". However, in my experience, they're all still usable. Then I create several "group" accounts that have specific purposes. I have created a "time" group, which allows any account that is set to be a member of the "time" group to change the system time. Another group called "print" allows a user to install printer drivers. So, Bill, you get the idea. Fine tuning in this manner gives a minor control freak all the control and safety that he/she may desire. Unfortunately, you need the "pro" version of XP to be able to easily tune your accounts. The "Group Policy" editor is only available on Win2k Pro and WinXP Pro. But, if you're interested in keeping a clean house, having restricted accounts goes a very long way in that direction. The extra few bucks it costs for XP Pro will be well worth it.
.