How common are Win XP "non admin" user accounts?

Hi,

Anybody have any idea how common Windows XP "non adminstrator" accounts are?

If a user has one of those, they are a bit limited in what they can install. For example, they can't install the MS .net framework.  Can't make changes to any folders under Program Files or Windows.

So, they have to get an administrator to do the install.

I've not encountered this much with home users or our users at hospitals here in the US, but it's supposed to be standard in the near future in Australia (one of the countries in which we have a distributor).

Mr. Analogy
Friday, March 26, 2004

Any company with a real IT department already does this. IT will tend to reserve Admin privileges for their own uses, while the folks who sit in front of the thing all day simply have to use what they are given. They've been doing this for YEARS with domain accounts an NT boxes of all flavors (the NT 4.0 box on my desk, for instance, I don't have the admin password to. So there are some limits (in our configuration, not too many) as to what I can install on it.

Michael Kohne
Friday, March 26, 2004

I haven't seen much in home environments, either. In offices, it's more common, especially in larger companies.

Our "web-surfing" home user is non-admin. Don't feel much in terms of limitation, really. OK, so I can't change the clock. Who cares? :)

As for installations, all sw I've seen says you must be running as admin in order to install it.

Paulo Caetano
Friday, March 26, 2004

At work, no one is allowed admin accounts.  This means that the IT dept. doesn't have to deal with (possibly malicious) custom screensaver installations, IM clients, Kazaa and other even more retarded programs that people have a mind to install[1].  So there's a real benefit to doing this.

At home, I log on as admin on XP, all the time.



[1] - "But shouldn't your firewall trap/log programs that access the internet?" - But who cares?  Why allow the installation of such things if it's preventable in the first place?

pds
Friday, March 26, 2004

On my laptop my main account is the admin account, it's too much of a pain in the arse otherwise. 

I made an account for my wife so she could rip CDs and copy them to her MP3 player.  But she gets access violations, so she always uses my account now anyway.

Maybe if the user account was more useful it would be used more.

Snotnose
Friday, March 26, 2004

If you want to install a program while logged in as a user, then right click on the icon and choose 'run as'. This will allow you to run or install a program under another name (normally local administrator), if you know the password.

Don't use it to merge registry files to the local user account though, particularly if said registry file is a draconian list of prohibitions. It will  merge the file into the user account you have logged on as. Not a bug but a feature, and one that can really bite!

Stephen Jones
Friday, March 26, 2004

or from the command line

runas /user:xxxx <exe>

Dan G
Friday, March 26, 2004

It's standard in medium and large organisations. At Telstra in Australia, at one stage and possibly still, users couldn't make any changes to their desktop at all.

You Vill Use De Corporate Wallpaper.

There are lots of organisations that even deny Admin accounts to developers, and Microsoft is adapting developer tools to conform with this. I'm not sure this is the best solution to this issue, but there you go.

Installers are meant to be able to install without Admin privileges if possible, and mine are written that way. Otherwise, a good installer will ask for Admin privileges when required.

echidna
Friday, March 26, 2004

"Installers are meant to be able to install without Admin privileges if possible, and mine are written that way."

How can they when the ACL on Program Files is only allowing Users read/execute access?

Duncan Smart
Friday, March 26, 2004

The privilages keeps beginner users from destroying their work computers. One of the beginner mistake is to install anything they see advertised or downloadable. If a department OKs a software purchase though, even a shareware one, it probably means they have the done the required stability testing that gives them the okay to install it on your software buyer's systems.

Li-fan Chen
Friday, March 26, 2004

"One of the beginner mistake is to install anything they see advertised or downloadable. "


1.  Users often need to try out a few (or 20 in our case) programs before they decide which ones they want to purchase.

"If a department OKs a software purchase ... means they have the done the required stability testing that gives them the okay to install it..."

Who do you think does this testing? It's the user you're advocating we not allow to test with a trial version.

When have you EVER heard of IS *testing* software?

Mr. Analogy
Friday, March 26, 2004

"How can they [block installations] when the ACL on Program Files is only allowing Users read/execute access?"

Some installers can install to directories other than Program Files.  So you might have to stuff your game or whatever into My Documents or something, but you can do it.

Saturday, March 27, 2004

The msi installer program talks to the windows installer service which runs as the "local system account". So there's a mechanism that enables the user to install/uninstall files even without explicit privileges. It's supposed to prevent the support calls that begin with "My computer won't start up. Do you think it's becuase there were too many files in the Windows directory? I deleted all the useless ones."

A.T.
Saturday, March 27, 2004

Often what is done is to leave the local administrator account open.

The idea is that people who know how to log on to their machines as local administrator are savvy enough not to mess them up.

Incidentally it is an excellent idea to force developers to do all work logged in as a regular user. That way they won't make presumpitons that what works for them will work for everybody.

Stephen Jones
Saturday, March 27, 2004

  Recent Topics

  Fog Creek Home