User accounts, Administrator can't be administrator?

[tazman]

I'm in the process of setting up a new X40. When the setup routine prompted for naming users it would not let me make an "Administrator" account so I picked another name. The account that I set up with another name *is* the Administrator account and I am prevented from re-naming this account to "Administrator". Can anyone explain?

taz

[bhtooefr]

It's an XP-ism.

Option 1: Disable the Enhanced Login thingy (or whatever it's called - the setting is right next to the setting to disable Fast User Switching). Administrator will then work, but you won't be able to click on usernames to log in any more. On a laptop, though, that can help increase security.

Option 2: Computer Administrator level accounts have just as high privileges as the Administrator account. So, pick a name, and use that.

[jdhurst]

It is more an IBM'ism than an XP'ism. Straight Retail XP starts with administrator as an account. IBM machines (at least the Desktops and Laptops I have used) assign the first user as the "owner" which is also an administrator. The very newest IBM's require a password for Administrator; earlier ones did not, and it is essential to do this manually. If you want a restricted user account, that would be a third account.

Whatever, make sure *all* active accounts have strong passwords. There will be, by now, lots of exposed XP machines with Administrator / no password as a working admin account.
... JD Hurst

[bhtooefr]

Hmm... I remember that when one DOES get XP to install without a user account, it forces you (or at least nags a LOT) to put on a non-"Administrator" (but with Admin privs) account ASAP...

[egibbs]

I'm in the process of setting up a new X40. When the setup routine prompted for naming users it would not let me make an "Administrator" account so I picked another name. The account that I set up with another name *is* the Administrator account and I am prevented from re-naming this account to "Administrator". Can anyone explain?

taz

The short answer is you already have an account called Administrator - it was set up by XP, so you can't create another with the same name. You can't see the Administrator account on the friendly login screen, but it's there. Boot into Safe Mode and you'll see it.

Ed Gibbs

[jnumiker]

http://download.microsoft.com/download/ ... ySetup.exe

Using this tool you can un-hide the existing Administrator account from the login screen as well as change a number of settings/preferences on your UI experience in XP.

[mrdeucie]

I also find this a bit annoying as I have 4 accounts open when I would really prefer three:

Administrator Account (Administrator Rights)
Admin account (Administrator Rights)
my account (Limited rights)
my girlfriend's account (Limited rights)

[FRiC]

What I do is at the installation process where it asks you to create a user that has admin rights, power off the computer and it will boot into XP with the "Administrator" account.

[mrdeucie]

What I do is at the installation process where it asks you to create a user that has admin rights, power off the computer and it will boot into XP with the "Administrator" account.

I guess that would eliminate account #2 for me. I'll have to try it the next time I format and reinstall. Thannks for the tip. Are there any ill effects that can be caused by not fully completing the install?

[jdhurst]

@mrdeucie - It is quite easy to do what you want, although if you already have set up accounts, it may be a bit tricky.

Here is what I do:
1. Start the machine from new or fresh install.
2. At the screen where it wants the first user (the owner id), enter mrdeucie_admin or some such. That will be an administrator ID.
3. Set the properties to standard login (not fast user switching)
4. Assign passwords to "administrator" and "mrdeucie_admin".
5. Set up two limited user accounts with passwords.

At that point, you have what you want. I think you can restore fast user switching, and it should work. I don't use fast user switching and cannot say for sure. ... JD Hurst

[mrdeucie]

@mrdeucie - It is quite easy to do what you want, although if you already have set up accounts, it may be a bit tricky.

Here is what I do:
1. Start the machine from new or fresh install.
2. At the screen where it wants the first user (the owner id), enter mrdeucie_admin or some such. That will be an administrator ID.
3. Set the properties to standard login (not fast user switching)
4. Assign passwords to "administrator" and "mrdeucie_admin".
5. Set up two limited user accounts with passwords.

At that point, you have what you want. I think you can restore fast user switching, and it should work. I don't use fast user switching and cannot say for sure. ... JD Hurst

Thanks for the advice JD, but it would seem that I would still end up with 4 accounts using the method described, two accounts with administrator rights and two with limited accounts.

Although, with my current setup, during fast user switching there are only three accounts that show up, I would rather only have the two limited accounts show and have the administrator account hidden.

Ideally I would want one account with administrator rights (installing software) and two with limited rights for regular computing.

[jdhurst]

You could try setting the owner user as standard or restricted. I started to do that, but did not follow through as that is the userid I always use. You can also give accounts new names. So that combination of things might work.

Now take a different point of view. If your account is the owner account and is admin by nature, then secure your machine (firewall, antivirus, anti-spyware, and fully patched), use it carefully and operate in admin mode. I do that, and on no occasion ever since 1994 have I ever been hacked or compromised. So in my opinion, there is no real problem with having your account as owner.

... JD Hurst

[mrdeucie]

That was what I wanted to do but I think the XP that is distributed with Thinkpads require that at least one other account besides the "administrator" has admnistrator rights.

[jdhurst]

Ok, but the owner account *is* the one other account.

Do this:
1. Eliminate every and all accounts except (a) the built-in "administrator" account and (b) the owner account. This is the account that the ThinkPad makes you have and it is also an administrator account.
2. Check in My Computer -> Right Click -> Manage -> Users and Groups -> Users to see that there is only the two accounts. You might also have a couple of disabled accounts but don't worry about those.
3. Now switch to fast user mode and start up. You should only see one account (your account, owner account and administrator all in one account). Is this true?
4. Now add one limited account.

I know from setting up client computers that this works, so good luck.
... JD Hurst

[mrdeucie]

That is correct.

Although, my goal would be to have only the built-in administrator as the only one with administrator rights and to have two limited accounts, one of which would be the owner account.

1. Built-in administrator (Administrator rights)
2. Owner account (Limited)
3. Another account (Limited)

I don't think this is possible. On my desktop this is the pretty much the way it is setup except there are more limited accounts.

[hkhalil]

Hi mrdeucie,

I know what you mean, I aim for the same sort of thing.

The advice here about the built in Windows "Administrtor" account is spot on. There is one by default and you can't create another with the same name. As far as i remember, it doesn't have a password either.

I play along with Windows and create the account it wants me to (I call it tempadm because I will delete it later). So I'll have the default real Administrator account, and the other temporary one I've just created. When Windows is done you can press CTRL ALT DEL twice to bypass the fast-switching screen and get to the regular log-on box. I log-on with the blank passworded account called "Administrator" and delete the tempadm account. This is a good time to give this real admin account a password.

I'm part of a domain, so I don't put a user account on the machine for myself, but you can do this now for you and your girlfriend. If you're keen on security you might want to rename the administrator account to something else less obvious. Windows also has another built in account called "Guest" you can rename this too, but I think it's dissabled by default.

I've gone on for long enough, best of luck

[mrdeucie]

So what you are essentially saying is that after the tempadmin account has been created. I can log on to the administrator and delete the tempadmin account with no adverse effects?

[hkhalil]

Hi mrdeucie,

I can't say that with my hand on my heart, it's only how I do it. I haven't noticed any ill effects. If it can't be done, Windows should tell you that "You can not delete this account", or something like that. you may need to set up one other account (your regular account) before you delete tempadm.

From what I know of Windows; you can have many users who have admin rights, but there must be at least one. The built-in Administrator account will do this job. In fact, from the behaviour I see; this account is the account that Windows considers to be the machine's true administrator (because it was built-in). To illustrate this point: the bit I mentioned in my earlier post, about renaming the administrator account, is something that is a setting of Security Policy/Group Policy (forgive me if you're familiar with all this). When you change this setting, it is that built-in account which gets it's name changed - not the one you create as "owner" during install. This is why I believe that deleting the tempadm account works for me.

JDHurst is right about minimising your risks with AV and firewalls, because if you do decide to give your daily account admin rights; any code that hijacks your account will have whatever access you do. It would be free to do all manner of things. This is one reason i don't use it for day-to-day computing. I try to go down the "run as" route if I can. Even if your security is good, I've been saved many a time by an "Access Denied" message when being too eager to delete someting I shouldn't.

I'm sorry if I ramble on in my posts, but I try to give people as much info as i have so that they can decide what's best for them. If anything i say is incorrect, someone please feel free to correct me. I'm learning too.

hope this helps

[mrdeucie]

hkhalil,

Thanks for your reply. I've tried deleting my "tempadmin" account but it seems that I am not able to. The option to delete the account is not available. I thought that it may not have been there because it was an admin account so I thought to change it to a limited account. Unfortunately, the OS will not allow me to change the "tempadmin" account unless another account is assigned with administrator priviledges. Unless there was something else I was to do, it looks like I'm stuck.

[hkhalil]

Hi mrdeucie,

That's a shame.. It works for me. I'm trying to remember the exact order i do things, but this is what I end up with: (click to enlarge)



As you can see, just two accounts and both are built-in. The bottom one is the renamed "Administrator" account. I have had the same thing you describe in the past. It may have someting to do with the user switching/welcome screen. I suspect it could be due to password hints or recovery (which you don't have with CTRL ALT DEL) - I may be wrong. Anyhow as you know, Windows sets up with the welcome screen, but I don't use it; I tend to dissable it so that Windows doesn't auto-login with that "owner" account every time I need a restart (as is common when first setting up). It could be like jdhurst advised: you need to make these changes with user switching dissabled; when you switch back, you may get what you're after.

Also, I'm using the 5CD recovery discs from IBM not the factory restore from HD. The disks I have come with SP2 slipstreamed on. I doubt that would be a big deal, but maybe the setup is slightly different ?

This is all i can think of for now, hkhalil

[mrdeucie]

Thanks again for the tops hkhalil.

I'll try again over the weekend when I have time.

[mrdeucie]

I've tried disabling the welcome screen and fast user switching and trying what you suggested but it seems that it is not possible to delete the extra administrator account without creating another.

[bhtooefr]

Try using whatever the advanced mode is. It lets you do a LOT more stuff, and doesn't try to protect you from yourself.

[hkhalil]

Hi Mrdeucie,

The only thing I can guess at is that it's because I'm part of a domain. Even the layout of my control panel changes. I don't have the option to "Change the way users log on and off the computer". Perhaps the restricitions that apply to accounts are different in this mode.

I assume that as a stand alone machine; Windows still has the built-in Administrator account, but also sets up the owner account who will be in charge of the machine. If that's the case then it's just an XP-ism of sorts.

As a workaround, you could try and remove the tempadm account from the Administrators Group via Computer Management/Users & Groups (if you haven't tried that already); perhaps you can delete it then. If it doesn't let you remove it form the group or delete it, will it let you dissable it ? It wouldn't be gone, but at least it can't be used as easily.

Best of luck, hkhalil

[mrdeucie]

Hi Hkhalil,

It seems you were right. The reason the "tempadmin" account could not be deleted because it was part of the admin group.

This thread will be good for any future and current users that are having problems removing the mandatory admin account that has to be created.

Before going ahead with this change I would recommend creating a system restore point just in case anything goes wrong so that you may revert to it at a later point.

To remove the admin account from the administrators group, log in as the real Administrator and go to:

• Start;
• Programs;
• Administrative tools;
• Computer management;
• Expand System tools;
• Expand local users and groups;
• Expand groups;
• Double click on Administrators;
• Choose the "extra" adminstrator account that was created during XP setup;
• Choose the "remove" option; and
• Now open up user accounts from the control panel and you should be able to delete the "extra" administrator account

I have not seen any ill effects yet from deleting the "extra" administrator account. As I am no expert I would take my advice with a grain of salt and only use it at your own risk.

Thanks to all the contributors to this thread.

[hkhalil]

I'm happy to have helped. hkhalil