14. Change the Account Type
A computer administrator account can change the type of account assigned to other accounts on the system. For example, a computer administrator account can be changed to a limited account or vice versa. Because any computer administrator account can change the account type for all other accounts, computer administrator accounts are not protected, meaning that one administrator can demote another administrator to a limited account. Note It really makes sense and is definitely a best practice (I think you would agree) to have just one computer administrator account on a computer. All the other accounts can then be limited. Allow multiple computer administrator accounts only in an environment where you are sure that the various administrator users aren't going to mess around with the other users' settings, particularly the account type. Change the Account Type
Note Windows XP Home is really designed for there to be one administrative account on the computer with all additional accounts existing as Limited accounts. This recommendation exists because administrative accounts can change the account type for any existing account, including other administrative accounts. For example, one administrator could demote another administrator to a Limited account. So, consider the whole account structure for any computer that is shared by multiple users. If one administrative account demotes another administrative account to a Limited account, there are no repercussions on the system other than that the former administrator can no longer change other users' account settings or change administrative settings on the computer. |