View Poll Results: Running with privileges.

Voters
34. You may not vote on this poll
  • Yes

    19 55.88%
  • No

    15 44.12%
Page 1 of 3 123 LastLast
Results 1 to 15 of 38
  1. #1
    New Lounger
    Join Date
    Mar 2010
    Location
    Austin, TX, USA
    Posts
    5
    Thanks
    0
    Thanked 0 Times in 0 Posts
    About a year ago, I 'upgraded' from Windows 98 on an old computer to Windows XP Home on a reasonably fast new one (which I built). I had often seen folks criticized for running regularly under XP with admin privileges, as this supposedly increases one's risk from malware. I also wanted automatic login when I powered up; and, as I understand it, this can only be done for non-admin accounts. So I set up an account with limited privileges which I will call User. I also had my Admin account. Trying to run primarily as User has caused me all sorts of problems. I regret that I set up two accounts on the machine. I regret it so much that I am inclined to reinstall XP with but a single account. But before I do that, I thought I would check and see if there is something I was missing that could allow me to be happy running without privileges most of the time. So, in the following, I am going to describe some of the types of annoyances which I believe have arisen from my decision to create two accounts. Hopefully this information will enable some folks to give me some relevant advice and/or pointers. Thanks in advance for any help.

    Whenever I install something, I have to run as Admin. There are a number of programs I have that I cannot run successfully as User. iTunes is one of them. There are plenty of others. Some will mostly run, but there are certain things that they cannot do. I think this is because such things requires updating information that 'belongs' to Admin, and these programs were not properly designed for XP. (A trivial example is Hoekey. With that, I frequently want to introduce new keyboard shortcuts and the like, but it keeps its configuration file in an area not accessible to User. But I am almost always User when I discover something I want to add.)

    (An odd exception is an old version of BlueSoleil (a Bluetooth stack) which came with a USB Bluetooth adapter I bought recently. It works (most of the time) only for the first account logged in, which is User on power up. I cannot start it for Admin.)

    As far as I am concerned, both Admin and User are really me, just with different privileges. Thus it is a constant annoyance that Admin and User cannot share the same profiles. I have separate user profiles for important applications like Firefox. I still need to use the browser when logged in as Admin - e.g., to get help for configuration issues from forums like this one. I want the profiles to be the same; but they constantly get out of sync. I cannot read my email when I am Admin, because the relevant profile for that is User's. (I can send email OK as Admin.)

    When I have to log in as Admin to handle some configuration issue that I cannot as User, I no longer have the context that motivated me to make the change; so, to finish it, I have reconstruct what I was doing before I realized that I needed to be Admin.

    I think I encounter Windows XP bugs as well. For example, if I leave Admin logged in when I go back to User, it is not unusual for Windows to 'lose' its profile for Admin. In particular, when I go back to Admin, I am told that Windows cannot find my profile data and that it is logging me in under a temporary account. If I reboot, normal access to my real Admin account (and the associated profiles) is restored. (This bad behaviour is a reason that I am considering reinstalling XP rather than just eliminating the current User account.) Another thing that can go wrong is that the graphics driver for Admin can get fouled up. We're talking about ATI Catalyst Center. It breaks and XP wants to "phone home" about it. (The problem is not even that serious, because it can be restarted OK.) As User I don't see this, and when I attempt to go to standby, I am surprised to discover later that it did not work because of the current hangup for Admin.

    Clearly the solution adopted in both Vista and Ubuntu is a much better way to deal with these issues. You need only one account (with one set of profiles) and you normally run without privileges. However, you can acquire them briefly to do something that really needs them. I think something somewhat like this exists for an unprivileged account in XP, but it does not work when the Admin account has no password. Even though my computer is situated securely in my home where no one can access it without my knowledge, I figure I need to bite the bullet and go ahead and put a password on Admin.

    I think there may be reasons to be less paranoid nowadays about running with Admin privileges in XP. E.g, I use NoScript in Firefox; I have a hardware firewall in the form of a NAT router; and I have a software firewall (Online Armor). The software firewall seems to step in with respect to all the dangerous sorts of actions that would require privileges. I.e., I am reminded that what I want to do requires privilege (that I already have - but before invoking). The SP3 upgrades to XP also seem to have introduced more of those "Are you sure you want to do this?" types of reminders.

    So what do folks think? Am I foolish to go back to a single-account configuration? Or is there a better way to live with an unprivileged User account?

  2. #2
    5 Star Lounger
    Join Date
    Dec 2009
    Location
    South of the North Pole
    Posts
    919
    Thanks
    0
    Thanked 0 Times in 0 Posts
    You pretty much have it dead to rights. XP was designed before there was hardly any clamour or need for reduced priveledges and there was very little attention paid to its function and its one of the few things in XP that sucks.

    Fortunately there are hardware routers and sandbox techniques that allow one to run intelligently "naked to the wind" if so desired. In other words, there are plenty of alternative methods to interact safely even with a full-on admin account.

  3. #3
    New Lounger
    Join Date
    Mar 2010
    Location
    Berkeley, California, USA
    Posts
    1
    Thanks
    0
    Thanked 0 Times in 0 Posts
    It's important to distinguish between the account called "Administrator" and (other) accounts with administrator rights. The account named Administrator is best left unused, reserved for emergencies. In XP Home it's mostly not visible, except when you boot into Safe Mode.
    Most people agree that trying to work in a limited user account is too annoying and frustrating to tolerate, and want to use an account with administrator rights. I recommend using an account with administrator rights, and a protective shell or sandbox around programs which might be vulnerable (your web browsers and others that use the Internet). I use DropMyRights. See here for how to use it and where to download it.
    You shouldn't have to re-install Windows to change your accounts. Probably what you'll want to do is give administrator rights to your User account (and rename it if you want) and then remove your admin account (if it's not the one named "Administrator").

  4. #4
    New Lounger
    Join Date
    Mar 2010
    Location
    Austin, TX, USA
    Posts
    5
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Quote Originally Posted by Max Weinryb View Post
    It's important to distinguish between the account called "Administrator" and (other) accounts with administrator rights.
    And I failed to do so. What I was calling "Admin" is really named "David" and I gave that account administrative privileges. It is what I use to administer the machine. The real Administrator account remains well hidden.

    Thanks for the pointer to DropMyRights. That is a good solution. Indeed, the page for it also enumerates some of the annoyances of running without privileges - a couple of which I had not personally encountered (yet).

    You shouldn't have to re-install Windows to change your accounts. Probably what you'll want to do is give administrator rights to your User account (and rename it if you want) and then remove your admin account (if it's not the one named "Administrator").
    I was thinking of moving User's profiles over to (my) Admin account and deleting the User account. However, there are some scary symptoms I get (like XP losing Admin's (top level) profile) and which make me want to go ahead and reinstall. I also suspect that the installations of some of my apps has been compromised by the split, so I am willing to reinstall (all of) them. Besides, I now have a copy of XP Pro which I can install instead of XP Home.

  5. #5
    Super Moderator CLiNT's Avatar
    Join Date
    Dec 2009
    Location
    California & Arizona
    Posts
    6,121
    Thanks
    160
    Thanked 609 Times in 557 Posts
    I think something somewhat like this exists for an unprivileged account in XP, but it does not work when the Admin account has no password. Even though my computer is situated securely in my home where no one can access it without my knowledge, I figure I need to bite the bullet and go ahead and put a password on Admin.
    I like to run as full admin. I know my system and setup. Less pain in the butt to have to switch, or log in to
    change something.
    Limited user accounts are good too from a security point of view, especially for inexperienced users.
    It sounds like your used to, and comfortable with the limited account, with some notable caveats, so if I where you I would
    just go ahead and create that admin password. If you find that it's not to your liking, you can always change it.
    It seems pointless from a security point of view not to have a logon password in the first place, especially with other user accounts, and even if you are the only one present.

    Having a logon password for any computer user is among your first lines of defense.

    as a side note:
    Sand boxing applications are not as secure as you may be led to think and they will add slugishness to a system, especially XP.
    DRIVE IMAGING
    Invest a little time and energy in a well thought out BACKUP regimen and you will have minimal down time, and headache.

    Build your own system; get everything you want and nothing you don't.
    Latest Build:
    ASUS X99 Deluxe, Core i7-5960X, Corsair Hydro H100i, Plextor M6e 256GB M.2 SSD, Corsair DOMINATOR Platinum 32GB DDR4@2666, W8.1 64 bit,
    EVGA GTX980, Seasonic PLATINUM-1000W PSU, MountainMods U2-UFO Case, and 7 other internal drives.

  6. #6
    New Lounger
    Join Date
    Dec 2009
    Location
    Australia
    Posts
    4
    Thanks
    0
    Thanked 0 Times in 0 Posts
    “David wrote: I 'upgraded' from Windows 98 on an old computer to Windows XP Home “

    David, if you installed Windows XP Home over Win 98, I would definitely do a clean install of XP.
    As you have a copy of XP Pro, it's worthwhile doing this anyway, as the XP Pro version is more
    secure than the Home version [url="http://www.dslreports.com/forum/r23828377-Is-XP-Pro-more-
    secure-than-XP-Home"]

    On a single user PC, that is up-to-date with all the latest MS patches, updated and patched 3rd party
    software and solid security programs installed, I don’t see any reason to run that PC with limited
    privileges.

    Then, if your PC is say, a family PC where your children have access, it’s a whole different kettle of fish.
    In that case, you would need to create at least one other account (or one for each of the kids) with limited
    privileges and password protect your computer administrator account. I’ve worked on many PC’s that were
    totally messed up by unexperienced users (or kids who think they are computer whizzes). The whole idea
    behind giving them limited privileges is, that no harm can be done to your precious machine by them say,
    deleting system files, installing unwanted or infected software or messing around with your files. And those
    examples are exactly some reasons why you DON’T want to give your kids (or others who should not have
    full access on your machine) full administrative rights. Sure, functionality is somewhat reduced and some
    programs and utilities may not fully work in a restricted account, but that is exactly the idea behind it!

    That brings me to the poll question of this thread: ”Should I go to a single-account configuration?“

    This of course cannot be answered with a simple yes or no answer. In your case, if you’re the only user, then
    the answer is yes, you having full administrative privileges. If others have access to your PC, then the answer
    is no. In that case, of course password protect your account and let them use either the Guest Account (enable
    in control panel/user accounts), or create an account for them with restricted privileges.

  7. #7
    3 Star Lounger djohnson's Avatar
    Join Date
    Dec 2009
    Location
    Delaware City, Delaware
    Posts
    323
    Thanks
    13
    Thanked 32 Times in 30 Posts
    I have never run an XP computer without administrative privileges. Seems rather pointless, don't ya think? I also have never had any problems with viruses, attacks, whatever just-so-long as I have run Windows Defender and some sort of anti-virus! I am the only account on my computer so it is pretty much taken for granted that I would have automatic login. Of course Windows XP is so, like, yesterday! I am, of course, running Windows 7 Ultimate 64 bit, also with automatic login and administrative privileges. If you can I would suggest putting Windows 7 on there. It will most likely run better than Windows 7!

  8. #8
    3 Star Lounger
    Join Date
    Mar 2010
    Location
    USA
    Posts
    301
    Thanks
    65
    Thanked 39 Times in 30 Posts
    Drop MY Rights is generally good if you use it to lower your admin rights on the web browser shortcut.
    Whether one user as admin or assigning two accounts, one admin and one limited user, there are many arguments and preferences.
    I prefer two: one admin and one limited. The rationale is that most of the time you are a user, not a constant tinkerer. If you are 50-50, well, you'd have to decide.
    A limited user has one basic protection: software installation is denied.
    It is a great way to protect yourself, even if you are tired or absent minded, such as carelessly clicking an evil link in an email.
    With only limited rights, casual daily use will be protected without much ado. No one wants to be on guard, 24/7, high alert to boot. That's not the way to enjoy your PC.

    On the other hand, some software may not run under limited user account. Here is a trick:
    Log on as admin. Change the limited user account to admin rights. Log on to user account (now has admin rights), install the software, or whatever modifications you want to make. Then go to Start-Control Panel-Users. Set yourself (!) back to limited rights account. Reboot. Now even the limited user has rights to run the installed program.

    Why? The user is the 'owner' of the software files and folders. By owner I mean the user installs it.
    You can also do same via security permissions, by changing the owner, or permissions (full-control/execute/read/write/...) of the execution file(s). It is more involved and should be left to advanced users.

  9. #9
    New Lounger
    Join Date
    Mar 2010
    Posts
    1
    Thanks
    0
    Thanked 0 Times in 0 Posts
    If the DropMyRights program interests you, you might also take a look at the Sudown and Trust-No-Exe programs. They do things similar to DropMyRights.

  10. #10
    Lounger
    Join Date
    Dec 2009
    Location
    New Jersey USA
    Posts
    29
    Thanks
    0
    Thanked 4 Times in 3 Posts
    On my PC I login as Administrator every time.

    Bottom line is common sense usage of the PC.
    - Don't open emailed attachments from senders you're not expecting.
    - Don't click on Links that are offer free stuff or clearly bogus offers.
    - Keep Microsoft Updates fairly up to date.

    And install ONE decent Anti-Virus program or Security suite.
    And install a spyware scanning program as Spybot for on demand manual scans.

  11. #11
    New Lounger
    Join Date
    Dec 2009
    Location
    Boston, MA
    Posts
    1
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Coming from a Unix perspective, why have full rights if they're not needed?

    I log into & use my unix system without Administrator (root) privileges. The applications are written with the idea that those privileges are not needed. Mostly.

    The fix is usually file/directory rights. Some apps start with rights, do everything that needs those rights, then drop the rights.

    For installs, a dialog pops up to ask for a password before proceding. This can't be bypassed so a virus/trojan can't slip in w/o me doing something.

    FWIW, MacOS does this too.

    So, when I go on Windows, I'm very frustrated that there isn't something in place to elevate privileges when I install, run iTunes, etc.
    I'd like to have my son run as limited always. My wife & myself as limited with the ability to elevate.

    Most windows apps assume you have admin rights that can't be dropped. Why doesn't MS set things up the opposite way?

  12. #12
    New Lounger
    Join Date
    Dec 2009
    Location
    New Jersey
    Posts
    7
    Thanks
    0
    Thanked 0 Times in 0 Posts
    The one thing I would point out is that it is very easy to install any version of Windows and create the Administrator account with no password. Once that happens, the PC can be taken over by any user that can connect to it. A blank password is one of the first things a password guessing application will check. The Administrator account is normally only accessible in Safe Mode and most users don't think about assigning a password after installing Windows or setting up their PC.

  13. #13
    Lounger Will Fastie's Avatar
    Join Date
    Aug 2009
    Location
    Jarrettsville, MD USA
    Posts
    31
    Thanks
    2
    Thanked 2 Times in 1 Post
    It's too bad that this is only available in the Pro or Business versions of Windows, but the user type "Power User" really helps with this issue. It is not as dangerous as Admin but it allows many capabilities, most notably application installation. I have used it for years with friends, family, and clients and it is one reason I always recommend the "Pro" versions of Windows in spite of the additional cost.

    I think its presence would make the "Home" versions of Windows much safer.

  14. #14
    New Lounger
    Join Date
    Mar 2010
    Location
    Vancouver, BC
    Posts
    3
    Thanks
    1
    Thanked 0 Times in 0 Posts
    I run my home machines with all accounts limited except for an admin account called 'Janitor'. Many of the zero day unpatched threats are mitigated by running as limited user, and I want that protection.

    Most new programs will run in limited fine. For me, the key app that doesn't is Palm Desktop. Actually, Palm Desktop works fine in limited, but the Documents to Go program that works with it doesn't. So I created a shortcut in my limited user account to 'runas' the Palm Desktop program as Janitor. I just have to enter the password for the Janitor account each time.

    For my son's games that require admin to work, I use runasspc: http://robotronic.de/runasspc/. It keeps the admin password in an encrypted file. I'll admit the program is a bit rough around the edges, but it works. This way my son's account is limited, but he doesn't need the admin password to run his games, and I don't have to enter the admin password every time he wants to play.

    When using the Janitor account, I have desktop shortcuts to 'runas' Firefox and IE as my limited user. So, even though I'm in an admin account, the browsers (the entry point for lots of malware) are running limited. Plus, they are using my familiar profile from my limited user account and I don't have to deal with syncronizing the profiles between my limited and admin accounts.

    Quote Originally Posted by David Vanderschel View Post
    Whenever I install something, I have to run as Admin. There are a number of programs I have that I cannot run successfully as User. iTunes is one of them.
    I have been running iTunes as limited ok.

    I also had the problem you've had with my admin account saying it's profile was corrupt, creating a temp profile. After restarting, it would work properly again. I ended up having to reinstall XP to fix this. David, you should do a clean install of XP.

    Clark.

  15. #15
    New Lounger
    Join Date
    Feb 2010
    Location
    Sudbury, Suffolk, UK
    Posts
    4
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Quote Originally Posted by Tom Buskey View Post
    Coming from a Unix perspective, why have full rights if they're not needed?

    I log into & use my unix system without Administrator (root) privileges. The applications are written with the idea that those privileges are not needed. Mostly.
    I totally agree. I set up my XP account in the standard Unix/Linux way with one Administrator/root user and one ordinary limited-account user.
    O.K., so the former is needed for installation and disk management purposes (basically any task that requires access to areas outside the user's home directory), but,I've found, on average, I only need to access it one or two times a week. 99% of the time I log in to the limited user account and that's all I need. Even if some malfeasant gets hold of my identity while I'm online they'll only be able to mess with my user account - not my whole system.
    I suppose, you could say, it's slightly inconvenient that XP doesn't have the one user/sudo type account that Ubuntu and Mint have, but I'll place security over convenience any time.

Page 1 of 3 123 LastLast

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •