Time for a change

[Coke Robot]

I tried this out last night and by default, the first user account is an admin, while the new one is a standard account. But I'm sure that the first user account is a user ADMIN, not the system admin since I think there still is a built in admin account that isn't used normally.

But theoretically, the point of that is because you don't want the second user account to be an admin since they can lock you out of things on purpose or on accident.

 

[FSeal]

Yeah, I'm sure all of that is exactly the same is it is on windows 7....

 

[alphanumeric]

The first account created is a member of the administrators group. That is because the built in system administrator account is disabled by default. Built-in Administrator Account - Enable or Disable - Windows 7 Forums
The default admin account is subject to UAC, the built in system admin account is not.

 

[constantG]

I use a standard account, as do all members of my family and I do not have a problem typing in a password whenever I install a program. The way that I set the system up is thus:

1. First account is called ADMIN
2. From the ADMIN account I set up users e.g. Dad, Mum, blah blah. All of these accounts are standard and are subject to UAC which is great.

The problem I have with MS is that most people would set up their PC as thus:

1. Fist account is called DAD which has Admin rights
2. From the DAD account they would set up the rest of the accounts Mum, Daughter etc etc

This is flawed because if DAD is logged on he is opening the machine up to all the security flaws of the internet, and yes even if DAD is a super computer wizard he is still vulnerable from his own actions whilst playing around with windows essential files. At least doing it the way I do it, a password is required for any administrative actions.

Microsoft already install an account called Administrator to all windows systems by default. All I am saying is that they should use this Administrator account as the first account on the system and get the person who activates windows (i.e. DAD) to create himself a standard account for himself and all users. And if DAD doesn't want to do it that way then he could opt to set it up which ever way he likes. But at least the default option would be safer for all.

 

[FSeal]

Maybe, but the local administrator account is disabled by default because it is actually far MORE dangerous than the first user limited admin account for the person that doesn't know what they are really doing. Only "Dads" with serious Admin requirements and knowledge should be accessing that account. (I'm a programmer and a serious power user of windows and have never had tu turn on the full Administrator account on 7)

And most computers are single user machines with people that shouldn;t have access to most admin features anyway (Like 99.9% of them?) so going through the effort of setting up "ADMIN" as the limited admin account then setting up their "Me" account is a tad superfluous even though it would be a tiny bit safer. (Running as the limited admin account is reall no less safe from internet threats than the normal user account unless you turn off UAC)

SO, I agree that your stated scenario, might be the golden way to set up a multi user family machine, but it's not /really/ necessary for a single user machine and would have been even more confusing for most people setting up a windows box :/

It was a compromise to give the MOST security with the LEAST trouble to the NORMAL single user windows machine configuration. And even so, oh you remember the whinging about the fact that the user was not a full admin and had to OH NO click a button to allow an admin escalation for certain tasks? If it had been any more locked down people would have revolted completely :/

 

[constantG]

SO, I agree that your stated scenario, might be the golden way to set up a multi user family machine, but it's not /really/ necessary for a single user machine and would have been even more confusing for most people setting up a windows box :/

Fair point, I suppose that people that don't understand all of this will ensure that those specialists at PC World will still be required for some time to come!!!