Need help understanding Vista Administrator accounts.

http://support.microsoft.com/kb/926183/en-us#appliesto
talks about administrator accounts.

It says:
"By default, the following conditions are true in Windows Vista: . The
built-in administrator account is disabled.
. The built-in administrator account cannot log on to the computer in
safe mode.
Note In some cases, Windows Vista may determine, during an upgrade from
Microsoft Windows XP, that the built-in administrator account is the only
active local administrator account. In this situation, Windows Vista leaves
the built-in administrator account enabled. Additionally, Windows Vista puts
this account into Admin Approval mode."

To me, this means that every Vista system has a "built-in administrator"
account, but that on most systems it is disabled, but on others it may be
enabled and may be in 'Admin Approval mode'.

Questions:
1) What is the name of the "built-in administrator" account?
2) How can I enable it?
3) How can I access it?
4) How can I turn on and off 'Admin Approval mode'?
5) Where can I read up on what 'Admin Approval mode' means?

The document at the URL above goes on to say:
"An administrator account is a user account that lets you make changes that
affect other users. Administrators can change security settings, install
software and hardware, and access all files on the computer. Administrators
can also make a variety of changes to other user accounts.

When you set up Windows Vista, you must create a user account. This account
is an administrator account that lets you set up the computer and install
any programs that you want. After you finish setting up the computer, we
recommend that you use a standard user account for your day-to-day
computing. This practice helps make the system more secure."

To me, this means that the first account I create is always an administrator
account.

Questions:
1) This administrator account created during setup as the first account; is
it the same account or a different account than the "built-in administrator"
account?
2) Is there a special name for this first account created during setup?
3) Can 'Admin Approval mode' be turned on and off for this first account?

URLs that explain this stuff are greatly appreciated.
Thanks for any help you can give me.

-Paul Randall

"Paul Randall" <> wrote in message
news:...

>
> Questions:
> 1) What is the name of the "built-in administrator" account?


"Administrator"


> 2) How can I enable it?

1) Right-Click Computer > Manage > Local Users and Groups > Users >
Right-click Administrator > Properties.

2) Start > Run > "control userpasswords2" > Users tab > Highlight
Administrator > Properties....


> 3) How can I access it?

As above. Once enabled, the account will appear on the Welcome Screen.


> 4) How can I turn on and off 'Admin Approval mode'?

http://technet2.microsoft.com/Window....mspx?mfr=true

> 5) Where can I read up on what 'Admin Approval mode' means?
>

http://technet2.microsoft.com/Window....mspx?mfr=true

>
> Questions:
> 1) This administrator account created during setup as the first account;
> is it the same account or a different account than the "built-in
> administrator" account?


Different, obviously.


> 2) Is there a special name for this first account created during setup?


The user is prompted to enter a name for the account during
installation. How "special" this name is depends, I suppose, upon it's
meaning to the user.


> 3) Can 'Admin Approval mode' be turned on and off for this first account?
>

See above reference.





--
Bruce Chambers

Help us help you:
http://dts-l.org/goodpost.htm
http://www.catb.org/~esr/faqs/smart-questions.html

They that can give up essential liberty to obtain a little temporary safety
deserve neither liberty nor safety. -Benjamin Franklin

Many people would rather die than think; in fact, most do. -Bertrand Russell

Thanks for the response, Bruce
Responses in line.

"Bruce Chambers" <3t> wrote in message
news:%...
> "Paul Randall" <> wrote in message
> news:...
>
>>
>> Questions:
>> 1) What is the name of the "built-in administrator" account?
>
> "Administrator"
>
>> 2) How can I enable it?
>
> 1) Right-Click Computer > Manage > Local Users and Groups > Users >
> Right-click Administrator > Properties.

Local Users and Groups does not show up.

> 2) Start > Run > "control userpasswords2" > Users tab > Highlight
> Administrator > Properties....

Administrator does not show up, so I couldn't hightlight it.

I tried the Advanced tab, and clicked the 'advanced' button in the 'Advanced
User Management' section. This brought up a window titled lusermgr or
Iusermgr (I'm surprised the person who specified the default font didn't use
one in which all letters look alike - sorry about the rant) [Local Users and
Groups (Local)]. This window said something to the effect that the snapin
may not be used with this version of Vista (which is home basic).

Thanks for the URLs. I will read them and try the examples.

The URL I posted http://support.microsoft.com/kb/926183/en-us#appliesto
APPLIES TO
.. Windows Vista Home Basic.

Can Home Basic do anything with the "built-in administrator" account?
If so, how?

Do you have any URLs that clearly explain the nuances of differences in
administrator privileges in the many flavors of Vista?

>> 3) How can I access it?
>
> As above. Once enabled, the account will appear on the Welcome Screen.
>
>
>> 4) How can I turn on and off 'Admin Approval mode'?
>
> http://technet2.microsoft.com/Window....mspx?mfr=true
>
>> 5) Where can I read up on what 'Admin Approval mode' means?
>>
>
> http://technet2.microsoft.com/Window....mspx?mfr=true
>
>>
>> Questions:
>> 1) This administrator account created during setup as the first account;
>> is it the same account or a different account than the "built-in
>> administrator" account?
>
>
> Different, obviously.

Not so obvious on my Home Basic, so far.

>> 2) Is there a special name for this first account created during setup?
>
>
> The user is prompted to enter a name for the account during
> installation. How "special" this name is depends, I suppose, upon it's
> meaning to the user.
>
>
>> 3) Can 'Admin Approval mode' be turned on and off for this first
>> account?
> See above reference.

-Paul Randall

On Mon, 9 Apr 2007 17:03:56 -0600, "Paul Randall" <>
wrote:

>http://support.microsoft.com/kb/926183/en-us#appliesto
>talks about administrator accounts.
>
>It says:
>"By default, the following conditions are true in Windows Vista: . The
>built-in administrator account is disabled.
> . The built-in administrator account cannot log on to the computer in
>safe mode.
>Note In some cases, Windows Vista may determine, during an upgrade from
>Microsoft Windows XP, that the built-in administrator account is the only
>active local administrator account. In this situation, Windows Vista leaves
>the built-in administrator account enabled. Additionally, Windows Vista puts
>this account into Admin Approval mode."
>
>To me, this means that every Vista system has a "built-in administrator"
>account, but that on most systems it is disabled, but on others it may be
>enabled and may be in 'Admin Approval mode'.
>
>Questions:
>1) What is the name of the "built-in administrator" account?
>2) How can I enable it?
>3) How can I access it?
>4) How can I turn on and off 'Admin Approval mode'?
>5) Where can I read up on what 'Admin Approval mode' means?
>
>The document at the URL above goes on to say:
>"An administrator account is a user account that lets you make changes that
>affect other users. Administrators can change security settings, install
>software and hardware, and access all files on the computer. Administrators
>can also make a variety of changes to other user accounts.
>
>When you set up Windows Vista, you must create a user account. This account
>is an administrator account that lets you set up the computer and install
>any programs that you want. After you finish setting up the computer, we
>recommend that you use a standard user account for your day-to-day
>computing. This practice helps make the system more secure."
>
>To me, this means that the first account I create is always an administrator
>account.
>
>Questions:
>1) This administrator account created during setup as the first account; is
>it the same account or a different account than the "built-in administrator"
>account?
>2) Is there a special name for this first account created during setup?
>3) Can 'Admin Approval mode' be turned on and off for this first account?
>
>URLs that explain this stuff are greatly appreciated.
>Thanks for any help you can give me.
>
>-Paul Randall
>

While Microsoft claims that "an Account with Administrative privileges" (the
initial account the user created when installing Vista) has access to ALL
FILES, as well as the ENTIRE MACHINE, I must disagree.

ONE MUST take FORMAL ownership of ALL FILES and FOLDERS BEFORE he can change
them (or even open them) for any reason.

To do this, the user MUST ALSO give himself "SPECIAL PERMISSIONS", as well as
MAKING himself the "OWNER" of the machine, all folders, subfolders, and files
in each folder and subfolder.

So the initial user account does NOT give the user "access to ALL FILES, as
well as the ENTIRE MACHINE."

In other words, the initial user account does NOT have "Administrative
Priveleges", as Microsoft claims.

NOTE that the "USER" folder (and others) are INACCESSIBLE using Windows
Explorer until one takes formal ownership of them.

NOTE also that the "App Data" folder, "My Documents" folder, "Programs
Folder", etc, are completely inaccessible until the user takes formal
ownership of them.

NOTE ALSO that the user MUST take OWNERSHIP of ANY FILES, FOLDERS, and
PARTITIONS which were created under a DIFFERENT OS (even XP) by the SAME OWNER
before they are accessible.

I think that it's RIDICULOUS that the user who OWNS the machine MUST take
"OWNERSHIP" of it ENTIRELY BEFORE he can USE it.

Of course, I am sure the Microsoft lackeys in these groups will argue around
the facts I have observed.

But that's OK -- Vista needs all the help it can get right now. If it helps
Microsoft to sell their "latest and greatest" by LYING, then more power to
them. Of course, they must live with the consequences, both legal and in the
hit to its already poor image in the press.

After all, Vista IS a great OS, in spite of Microsoft's spin on the meaning of
"administrative privileges".

If I have failed to truly understand Vista's "administrative privileges", I
would really appreciate someone teaching me how to access ALL PARTITIONS,
folders, and files, as well as all devices, from the initial Desktop WITHOUT
taking formal control of them BEFORE I have access to them.

Donald L McDaniel
Please reply to the original thread and message.
================================================== ===

Donald

Can you shed light on how I use Vista to take "ownership" of the computer
and files. I agree with you, this is my computer and I should have full
control of MY Computer.

I understand MS's concern with security, I suggest they remove the
administrator account which every lowlife hacker in the world knows exists
and let me establish a strong-userid to control MY computer.

"Donald L McDaniel" wrote:

> On Mon, 9 Apr 2007 17:03:56 -0600, "Paul Randall" <>
> wrote:
>
> >http://support.microsoft.com/kb/926183/en-us#appliesto
> >talks about administrator accounts.
> >
> >It says:
> >"By default, the following conditions are true in Windows Vista: . The
> >built-in administrator account is disabled.
> > . The built-in administrator account cannot log on to the computer in
> >safe mode.
> >Note In some cases, Windows Vista may determine, during an upgrade from
> >Microsoft Windows XP, that the built-in administrator account is the only
> >active local administrator account. In this situation, Windows Vista leaves
> >the built-in administrator account enabled. Additionally, Windows Vista puts
> >this account into Admin Approval mode."
> >
> >To me, this means that every Vista system has a "built-in administrator"
> >account, but that on most systems it is disabled, but on others it may be
> >enabled and may be in 'Admin Approval mode'.
> >
> >Questions:
> >1) What is the name of the "built-in administrator" account?
> >2) How can I enable it?
> >3) How can I access it?
> >4) How can I turn on and off 'Admin Approval mode'?
> >5) Where can I read up on what 'Admin Approval mode' means?
> >
> >The document at the URL above goes on to say:
> >"An administrator account is a user account that lets you make changes that
> >affect other users. Administrators can change security settings, install
> >software and hardware, and access all files on the computer. Administrators
> >can also make a variety of changes to other user accounts.
> >
> >When you set up Windows Vista, you must create a user account. This account
> >is an administrator account that lets you set up the computer and install
> >any programs that you want. After you finish setting up the computer, we
> >recommend that you use a standard user account for your day-to-day
> >computing. This practice helps make the system more secure."
> >
> >To me, this means that the first account I create is always an administrator
> >account.
> >
> >Questions:
> >1) This administrator account created during setup as the first account; is
> >it the same account or a different account than the "built-in administrator"
> >account?
> >2) Is there a special name for this first account created during setup?
> >3) Can 'Admin Approval mode' be turned on and off for this first account?
> >
> >URLs that explain this stuff are greatly appreciated.
> >Thanks for any help you can give me.
> >
> >-Paul Randall
> >
>
> While Microsoft claims that "an Account with Administrative privileges" (the
> initial account the user created when installing Vista) has access to ALL
> FILES, as well as the ENTIRE MACHINE, I must disagree.
>
> ONE MUST take FORMAL ownership of ALL FILES and FOLDERS BEFORE he can change
> them (or even open them) for any reason.
>
> To do this, the user MUST ALSO give himself "SPECIAL PERMISSIONS", as well as
> MAKING himself the "OWNER" of the machine, all folders, subfolders, and files
> in each folder and subfolder.
>
> So the initial user account does NOT give the user "access to ALL FILES, as
> well as the ENTIRE MACHINE."
>
> In other words, the initial user account does NOT have "Administrative
> Priveleges", as Microsoft claims.
>
> NOTE that the "USER" folder (and others) are INACCESSIBLE using Windows
> Explorer until one takes formal ownership of them.
>
> NOTE also that the "App Data" folder, "My Documents" folder, "Programs
> Folder", etc, are completely inaccessible until the user takes formal
> ownership of them.
>
> NOTE ALSO that the user MUST take OWNERSHIP of ANY FILES, FOLDERS, and
> PARTITIONS which were created under a DIFFERENT OS (even XP) by the SAME OWNER
> before they are accessible.
>
> I think that it's RIDICULOUS that the user who OWNS the machine MUST take
> "OWNERSHIP" of it ENTIRELY BEFORE he can USE it.
>
> Of course, I am sure the Microsoft lackeys in these groups will argue around
> the facts I have observed.
>
> But that's OK -- Vista needs all the help it can get right now. If it helps
> Microsoft to sell their "latest and greatest" by LYING, then more power to
> them. Of course, they must live with the consequences, both legal and in the
> hit to its already poor image in the press.
>
> After all, Vista IS a great OS, in spite of Microsoft's spin on the meaning of
> "administrative privileges".
>
> If I have failed to truly understand Vista's "administrative privileges", I
> would really appreciate someone teaching me how to access ALL PARTITIONS,
> folders, and files, as well as all devices, from the initial Desktop WITHOUT
> taking formal control of them BEFORE I have access to them.
>
> Donald L McDaniel
> Please reply to the original thread and message.
> ================================================== ===
>