Removing Users from the Administrators Group

For reasons that I can't quite fathom, on Windows XP, Microsoft decided to make all local users members of the Administrators group by default. This may have been to reduce the number of support calls from people who said "My computer won't let me install this new hardware,"but I think it's a very bad idea to have users operate with Administrator privileges on a day-to-day-basis.

The Microsoft Users Accounts tool lets you assign users to either the Administrators group or the Users group, which has very restricted privileges. It also forces you to keep one regular user in the Administrators group, even though the Administrator account is still present (although usually hidden).

If you have a standalone computer or a computer on a workgroup network, I suggest that you do one of the following:

• Set up one account to use as the additional Administrator, use it only for installing software and hardware, and make all of your regular user accounts Limited users.

• Use the Local Users and Groups utility to remove your regular user accounts from the Administrators group, and add them to the Power Users group. This gives your users the ability to change settings like screen resolution without full Administrator power.

To set up Power User accounts, create the accounts using any of the normal means: User Accounts Control Panel, Local Users and Groups in Computer Management, and so on. Then, adjust their group membership by removing membership in the Administrators group and adding membership in the Power Users group. You can do this from the Local Users and Groups computer management too, but here's a trick you can use to make the job easier:

1.	Open a Command Prompt window and type the command control userpasswords2 If you are not currently logged on as a Computer Administrator, you will be prompted for the Administrator password.
2.	On the Users tab, select the first user account to be modified and click Properties.
3.	Select the Standard User setting. This assigns the user to the Power Users group.
4.	Click OK, and repeat with any other accounts you need to change. Just be sure not to change the settings for the Administrator account.

Figure 28.18. Use the UserPasswords2 control panel tool to assign users to the Power Users group.