Results 1 to 8 of 8

Thread: Can a standard user access the Admin account via Safe Mode?

  1. #1
    mgr Guest

    Can a standard user access the Admin account via Safe Mode?


    I have a situation where I want to be the administrator for my son's
    laptop, and convert him to a standard (non-admin) account. He originally
    set up the laptop, giving himself admin privileges, but he is no longer
    allowed to use it in that condition :(

    I am now the passworded local admin account (same account used to
    install Vista), and AFAIK do not have the system Administrator
    (upper-case A) account activated. He has a "standard" account. However,
    he is clever, and will try to work-around to get admin access. I've read
    the "recover password / activate Admin /etc." links in the forum, and I
    have a few questions:

    1. Can my local admin account OR the system Admin account be accessed
    and altered by a standard user in Safe Mode?

    2. Is it possible to block Method 3 (DVD boot for password reset) if
    the system is already properly set up for one admin's access?

    3. I do not see the "user groups" folder in Comp Mmgt Control Panel to
    enable or disable the system Admin account. How can I check its status?

    BTW, I'm using Vista Home Basic.

    Thanks,
    mgr


    --
    mgr

  2. #2
    barman58 Guest

    Re: Can a standard user access the Admin account via Safe Mode?


    Hello Mgr and welcome to the vista forums :party:

    First thing you may want to check is vista's built-in parental controls
    ...

    'Explore the features: Parental controls'
    (http://www.microsoft.com/windows/win...-controls.aspx)

    which should allow you to set limits for any standard account from your
    administrator account.

    as for the booting of a password reset cd or dvd which cannot be
    controlled from vista as it boots before vista does, the only way I can
    advise is this.

    go into the BIOS of the laptop and either remove the cd drive from the
    boot devices or set it to after the hard drive. that will stop anyone
    gaining access to the drive before vista boots. you should then be able
    to password protect the changing of the BIOS with a password Not
    foolproof - I have professional software that can defeat this but it is
    not generally available


    If you need to boot from a CD/DVD yourself it is a fairly simple matter
    to log into the BIOS change the setting and reboot

    hope this helps ...


    --
    barman58

    Regards,
    *Nigel*
    the beginning of knowledge is the discovery of something we do not
    understand.,- frank herbert

  3. #3
    FromTheRafters Guest

    Re: Can a standard user access the Admin account via Safe Mode?


    "mgr" <guest@unknown-email.com> wrote in message
    news:4decb1bab7b24203b8b99d370510f94b@nntp-gateway.com...
    >
    > I have a situation where I want to be the administrator for my son's
    > laptop, and convert him to a standard (non-admin) account. He originally
    > set up the laptop, giving himself admin privileges, but he is no longer
    > allowed to use it in that condition :(
    >
    > I am now the passworded local admin account (same account used to
    > install Vista),


    Not really, that account was created afterward.

    > and AFAIK do not have the system Administrator
    > (upper-case A) account activated. He has a "standard" account. However,
    > he is clever, and will try to work-around to get admin access.


    Activate and create a password for the *real* administrator, then
    deactivate it again. That way he won't be able to easily access that
    account.

    > I've read
    > the "recover password / activate Admin /etc." links in the forum, and I
    > have a few questions:
    >
    > 1. Can my local admin account OR the system Admin account be accessed
    > and altered by a standard user in Safe Mode?


    It shouldn't be possible.

    > 2. Is it possible to block Method 3 (DVD boot for password reset) if
    > the system is already properly set up for one admin's access?


    Disable or resequence the CD/DVD boot option in the CMOS and
    apply a password to the CMOS to make it more difficult to modify.

    > 3. I do not see the "user groups" folder in Comp Mmgt Control Panel to
    > enable or disable the system Admin account. How can I check its status?


    Type "net user Administrator" at the command prompt.

    Type "net help user|more" at the command prompt for usage of the
    net user command switches and options.




  4. #4
    mgr Guest

    Re: Can a standard user access the Admin account via Safe Mode?


    All,

    Appreciate the informative replies. Looks like I have a number of
    options to prevent workarounds. I'm _-hoping_- I don't have to do any of
    these yet.

    I'm still curious about that first established account, though. It's
    true the account didn't exist until we got the laptop (as Vista was
    already installed) but I've read that any changes to that first account
    (e.g. changing it from an admin to standard and creating a new admin)
    can create serious problems. Are people really referring to the system
    Admin account in these situations?

    Thanks,
    mgr


    --
    mgr

  5. #5
    FromTheRafters Guest

    Re: Can a standard user access the Admin account via Safe Mode?

    "mgr" <guest@unknown-email.com> wrote in message
    news:8cebcfb932676e6ba49f413724d4f087@nntp-gateway.com...
    >
    > All,
    >
    > Appreciate the informative replies. Looks like I have a number of
    > options to prevent workarounds. I'm _-hoping_- I don't have to do any of
    > these yet.
    >
    > I'm still curious about that first established account, though. It's
    > true the account didn't exist until we got the laptop (as Vista was
    > already installed) but I've read that any changes to that first account
    > (e.g. changing it from an admin to standard and creating a new admin)
    > can create serious problems. Are people really referring to the system
    > Admin account in these situations?


    When Vista sets up, it creates the "Administrator" account. After that
    it sets up the split token user/administrator account and disables the
    "Administrator" account and hides it from the user.

    The user/administrator is then prompted to create other standard user
    accounts as desired. If for any reason the last available account with
    administrator privileges is demoted or deleted - the OS should enable
    the "Administrator" account and make it available in safe mode.

    Unfortunately, it is possible to give the ASP.NET account administrator
    privileges and then demote or delete all other accounts without the OS
    enabling "Administrator". To the OS there is still an administrator level
    account - the problem then is the access to that account.



  6. #6
    barman58 Guest

    Re: Can a standard user access the Admin account via Safe Mode?


    Hi mgr,

    There is confusion as to when the FULL Administrator account is
    available in vista.

    of course it may be enabled using the NET USER command and will then
    appear in the log-in (by default with no password :( ).

    In XP when you entered Safe Mode you were automatically logged in as
    the FULL administrator this is NOT the default for Vista. If however
    there are no administrator accounts set-up in Vista then it is supposed
    to revert to the XP system (as a fall-back to prevent lockout). I say
    "supposed" as I have seen lockouts where re-install was the only remedy.

    As for the first account created by the user in vista this is by
    default an administrator account but as far as I am aware this is not
    "special" in any way.

    This account may be removed, (by another later created administrator or
    the FULL administrator account, but not if it's the only account on the
    machine), and I believe it may also be downgraded to a standard user
    even when it is the only administrator on the system, and this is why
    the reversion to XP behaviour was included for safe mode.

    Hope this helps ...


    --
    barman58

    Regards,
    *Nigel*
    the beginning of knowledge is the discovery of something we do not
    understand.,- frank herbert

  7. #7
    FromTheRafters Guest

    Re: Can a standard user access the Admin account via Safe Mode?

    "barman58" <guest@unknown-email.com> wrote in message
    news:0a563722690fa961418c09b21397d6a5@nntp-gateway.com...

    > As for the first account created by the user in vista this is by
    > default an administrator account but as far as I am aware this is not
    > "special" in any way.


    It is "special" in that it uses a split token (as opposed to the full
    token in the *real* administrator account). The account runs as
    a standard user until an action is requested that requires admin
    privileges. It then will prompt the user to "consent" to using the
    rest of the split token. They call this Admin Approval Mode or
    AAM for short.

    The same action requested in a regular standard user account
    will prompt the user to supply administrator credentials before
    allowing the action to take place.



  8. #8
    mgr Guest

    Re: Can a standard user access the Admin account via Safe Mode?


    Nigel,

    Thanks, that makes sense. Again, I appreciate the help.

    mgr


    --
    mgr

Similar Threads

  1. Replies: 8
    Last Post: 19-03-2012, 02:58 PM
  2. Replies: 1
    Last Post: 11-10-2011, 01:11 PM
  3. Unable to see PNG files in user account except admin account
    By Baiju Bavara in forum Operating Systems
    Replies: 6
    Last Post: 02-07-2011, 09:26 AM
  4. Stuck on a guest account, cannot access windows 7 admin account
    By LavaStones in forum Windows Software
    Replies: 1
    Last Post: 11-02-2011, 10:19 PM
  5. Standard User Account and User Account Controls Question
    By Susquehannock in forum Operating Systems
    Replies: 6
    Last Post: 06-08-2010, 05:38 AM

Tags for this Thread

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  
Page generated in 1,638,273,792.00822 seconds with 17 queries