Section 12.2. Setting Up Accounts | Windows XP for Starters: The Missing Manual: Exactly What You Need to Get Started

12.2. Setting Up Accounts

To see what accounts are already on your PC, choose Start Control Panel. Open the User Accounts icon; youll see a list of existing accounts (Figure 12-1).

If you see more than one account herenot just yoursthen one of these situations probably applies:

You created them when you installed Windows XP. All of the accounts you create when you first install Windows XP become Administrator accounts, as described in the following section.
You bought a new computer with Windows XP preinstalled , and created several accounts when you were asked to do so the first time you turned on the machine.
You upgraded the machine from an earlier version of Windows. Windows XP gracefully imports all of your existing accounts.

Figure 12-1. The User Accounts screen lists everyone for whom you've created an account. From here, you can create new accounts or change people's passwords. (Hint: To change account settings, just click the person's name from the "pick an account to change" section.

Warning: If you've upgraded from Windows 98 or Me, Windows XP (a) treats all of these imported accounts as Administrator accounts, described below, and (b)wipes out their passwords, which leaves open a security hole the size of Canada. Promptly after upgrading, therefore, you should take a moment to assign passwords and downgrade account types to Limited, as described below.

If you're new at this, there's probably just one account listed here: yours. This is the account that Windows XP created when you first installed it.

12.2.1. Administrator Accounts

It's important to understand the phrase that appears just under each person's name. On your own personal PC, the words "Computer administrator" probably appear underneath yours.

Because you're the person who installed Windows XP to begin with, the PC assumes that you're one of its computer administrators the technical wizards who will be in charge of it. You're the teacher, the parent, the resident guru. You're the one who will maintain this PC and who will be permitted to make system-wide changes to it.

You'll find settings all over Windows XP (and all over this book) that only people with computer Administrator accounts can change. For example, only an administrator is allowed to:

Create or delete accounts and passwords on the PC.
Install new programs (and certain hardware components ).
Make changes to certain Control Panel programs that are off-limits to nonadministrators.
See and manipulate any file on the machine.

As you go about creating accounts for other people who'll use this PC, you'll be offered the opportunity to make each one an administrator just like you. Needless to say, use discretion. Bestow these powers only upon people as responsible and technically masterful as you.

12.2.2. Limited Accounts

Anyone who isn't an administrator is an ordinary, everyday Limited account holder. "Limited" people have everyday access to certain Control Panel settingsthe ones that pertain to their own computing environments. But most other areas of the PC are off-limits, including everybody else's My Documents folders, Windows system files, and so on.

If you're a Limited account holder, in other words, your entire world consists of the Start menu, your My Documents folder, the Shared Documents folder, and any folders you create.

If a Limited account holder manages to download a computer virus, its infection will be confined to his account. If an administrator catches a virus, on the other hand, every file on the machine is at risk.

That's a good argument for creating as few computer administrator accounts as possible. (In fact, some Windows pros don't even use Administrator accounts themselves . Even they use Limited accounts, keeping one Administrator account on hand only for new software or hardware installations, account or password changing, and similar special cases.)

12.2.3. Adding an Account

Once you've opened the User Accounts program in the Control Panel, it's easy to create a new account: just click the "Create a new account" link, shown in Figure 12-1. (You see this link only if you are, in fact, an administrator.)

A wizard guides you through the selection of a name and an account type (see Figure 12-2).

When you're finished with the settings, click the Create Account button (or press Enter). After a moment, you return to the User Accounts screen, where the new person's name joins whatever names were already there. You can continue adding new accounts forever or until your hard drive is full, whichever comes first.

Tip: If you never had the opportunity to set up a user account when installing Windows XPif you bought a PC with Windows XP already on it, for exampleyou may see an account named Owner, already in place. Nobody can use Windows XP at all unless there's at least one Administrator account on it, so Microsoft is doing you a favor here. Just use the User Accounts program in the Control Panel to change the name Owner to one that suits you better.

Figure 12-2. Top: When naming an account in the User Accounts screen, you can keep it simple or get more elaborate. If it's all in the family, the account's name could be Chris or Robin. If it's a corporation or school, you'll probably want to use both first and last names. Capitalization doesn't matter, but most punctuation is forbidden.
Bottom: The "Pick an Account type" screen lets you specify whether or not this unsuspecting computer user will be a computer administrator, as described above.

12.2.4. Editing an Account

Although the process of creating a new account is swift and simple, it doesn't offer you much in the way of flexibility. You don't even have a chance to specify the new person's password, let alone the tiny picture that appears next to the person's name and at the top of the Start menu (rubber ducky, flower, or whatever).

That's why the next step in creating an account is usually editing the one you just set up. To do so, once you've returned to the main User Accounts screen (Figure 12-1), click the name or icon of the freshly created account. You arrive at the screen shown at top in Figure 12-3, whereif you are an administratoryou can choose from any of these options:

Change the name . You'll be offered the opportunity to type in a new name for this person and then click the Change Name buttonjust the ticket when one of your co-workers gets married or joins the Witness Protection Program.
Create a password . Click this link if you'd like to require a password for access to this person's account (Figure 12-3, bottom). Capitalization counts.

The usual computer book takes this opportunity to stress the importance of having a long, complex password, such as a phrase that isn't in the dictionary, something made up of mixed letters and numbers , and not "password." This is excellent advice if you create sensitive documents and work in a big corporation.

But if you share the PC only with a spouse or a few trusted colleagues in a small office, for example, you may have nothing to hide. You may see the multiple-users feature more as a convenience (for keeping your settings and files separate) than a way of protecting secrecy and security.

In these situations, there's no particular need to dream up a convoluted password. In fact, you may want to consider setting up no passwordleaving both password blanks empty. Later, whenever you're asked for your password, just leave the Password box blank. You'll be able to log on that much faster each day.

If you do decide to provide a password, you can also provide a hint (for yourself or whichever co-worker's account you're operating on). This is a hint that anybody can see (including bad guys trying to log on as you), so choose something meaningful only to you. If your password is the first person who ever kissed you plus your junior-year phone number, for example, your hint might be "first person who ever kissed me plus my junior-year phone number."

Figure 12-3. Top: Here's the master menu of account-changing options that you, an administrator, can see. (If you're a Limited account holder, you see far fewer options.)
Bottom: You're supposed to type your password twice, to make sure you didn't introduce a typo the first time. (The PC shows only dots as you type, to guard against the possibility that some villain is snooping over your shoulder.)

Later, if you ever forget your password, you'll be offered an opportunity to view this hint at sign-in time to jog your memory.

Tip: It's fine for you, an administrator, to create the original passwords for new accounts. But don't change their passwords later on, after they've been using the computer for a while. If you do, you'll wipe out various internal security features of their accounts, including access to their stored Web site passwords and stored passwords for shared folders and disks on the network. See the box on Section 12.2.4 for details.
Make your files private . The first time you make up a password for your own account, another screen asks: "Do you want to make your files and folders private?" If you're using the accounts feature more for convenience than for securityif you and your co-worker are married and have no secrets from each other, for exampleclick No.

But if you click the button labeled "Yes, Make Private," Windows takes a minute to mark everything in your user profile folder off-limits to other account holders. (Your user profile folder is the one bearing your name in the Documents and Settings folder on your hard drive.) Henceforth, if anyone else tries to open any of your files or folders (when they're logged in under their own names), they'll get nothing but a curt "Access is denied " message.

(Technically, making a folder private even shields it from the eyes of the machine's Administrator account holdersbut it's a pretty flimsy shield. A determined administrator can burrow past this wisp of protection to examine your files, if she's determined to do so, or even change your password late one night to gain full access to your stuff.)

Note that even if you do make your files and folders private, you'll still be able to share selected files and folders with other people. You just put them into the Shared Documents folder described on Section 12.3.3.

Tip: You can make any of your own folders privateor un-private, for that matter. Just right-click the folder; from the shortcut menu, choose Properties; click the Sharing tab; and turn "Make this folder private" on or off. To make your entire world un-private, for example, you'd perform this surgery on your user profile folder in the Documents and Settings folder (Section 4.2.1).
Change the picture . The usual Windows XP sign-in screen (Figure 12-4) displays each account holder's name, accompanied by a little picture. When you first create the account, however, it assigns a picture to you at randomand not all of them are necessarily appropriate for your personality. Not every extreme-sport headbanger, for example, is crazy about being represented by a dainty flower or butterfly .

If you like the selections that Microsoft has provided (drag the vertical scroll bar to see them all), just click one to select it as the replacement graphic. If you'd rather use some other graphics file on the hard drive insteada digital photo of your own face, for exampleyou can click the "Browse for more pictures" link (Figure 12-4). You'll be shown a list of the graphics files on your hard drive so that you can choose one, which Windows then automatically scales down to postage -stamp size (48 pixels square).

Figure 12-4. Left: Here's where you change your account picture, the one that appears on the Welcome screen and atop your Start menu.
Right: If you like to change your picture whenever your mood changes, there's a shortcut to this dialog box. Just click your account picture at the top of the open Start menu.
Change the account type . Click this link to change a Limited account into an Administrator account, or vice versa. You might want to use this option, for example, after upgrading a Windows 98 or Windows Me computer to Windows XPa process that otherwise leaves all existing user accounts as Administrator accounts.
Delete the account . See Section 12.2.6.

You're free to make any of these changes to any account at any time; you don't have to do it just after first creating the account.

Tip: If the User Accounts program looks nothing like the illustrations in this chapter so far, it's probably because you have only a Limited account. In that case, opening User Accounts in the Control Panel offers only a few certain links: "Create a password" (or "Change my password"), "Change my picture," and "Set up my account to use a .NET Passport". Only a computer administrator can make the other kinds of changes described here.

12.2.5. The Forgotten Password Disk

As described on Section 12.2.4, Windows XP contains a handy hint mechanism for helping you recall your password if you've forgotten it: the little ? icon that appears after you click your name on the Welcome screen. When you click that little icon, you're shown the hint that you provided for yourself if you provided onewhen setting up your account.

But what if, having walked into a low-hanging branch, you've completely forgotten both your password and the correct interpretation of your hint? In that disastrous situation, your entire world of work and email would be locked inside the computer forever. (Yes, an administrator could issue you a new passwordbut as noted in the box on Section 12.2.5, you'd lose all your secondary passwords in the process.)

Fortunately, Windows XP offers a clever solution-in-advance: the Password Reset Disk. It's a floppy disk that you can use like a physical key to unlock your account, in the event of a forgotten password. The catch: you have to make this disk now , while you still remember your password.

UP TO SPEED
Passwords Within Passwords

The primary password that you or your administrator sets up in the User Accounts program has two functions. You already know that it lets you log on each day, so that you can enter your Windows world of desktop clutter, Start-menu tailoring, Web bookmarks, and so on.

But what you may not realize is that it's also the master key that unlocks all the other passwords associated with your account: the passwords that Internet Explorer memorizes for certain Web sites, the passwords that get you into shared disks and folders on the network, the password that protects your .NET Passport (and its Wallet for electronic payments, if you set one up), and so on. The simple act of logging onto your account also unlocks all of these other secure areas of your PC life.

But remember that anyone with an Administrator account can change your password at any time. Does that mean that whoever has an Administrator accountyour teacher, boss, or teenager, for examplehas full access to your private stuff? After you leave the household, company, or school, what's to stop an administrator from changing your password, thereby gaining access to your electronic-brokerage account ( courtesy of its memorized Internet Explorer password), buying stuff with your Passport Wallet, and so on?

Fortunately, Microsoft is way ahead of you on this one. The instant an administrator changes somebody else's password, Windows XP wipes out all secondary passwords associated with the account. That administrator can log onto your account and see your everyday files, but not Web sites with memorized passwords, and so on.

Note that if you change your own passwordor if you use a Forgotten Password Disk, described nextnone of this applies. Your secondary passwords survive intact. It's only when somebody else changes your password that this little-known Windows XP security feature kicks in, sanitizing the account for your protection.

To create this disk, choose Start Control Panel. Open the User Accounts program. If youre an administrator, click your account name; if not, you can skip this step.

Either way, you should now see a link in the task pane called, "Prevent a forgotten password." Click that to open the Forgotten Password Wizard shown in Figure 12-5.

When the day comes that you can't remember your password, your attempts to get past the logon screen will be met by a "Use your Password Reset Disk" link.

Figure 12-5. The screens of the Forgotten Password Wizard guide you through the process of inserting a blank floppy disk and preparing it to be your master skeleton key. If you forget your passwordor if some administrator has changed your passwordyou can use this disk to reinstate it without the risk of losing all of your secondary passwords (memorized Web passwords, encrypted files, and so on).

When you click that link or button, Windows asks you to insert your Password Reset Disk, and then gives you the opportunity to create a new password (and a new hint to remind you of it). You're in.

Even though you now have a new password, your existing Password Reset Disk will still be good. Keep it in a drawer somewhere, for use the next time you experience a temporarily blank brain.

12.2.6. Deleting User Accounts

It happens: somebody graduates, somebody gets fired , somebody dumps you. Sooner or later, you may need to delete a user account from your PC.

To delete a user account, you, an administrator, must open the User Accounts program, click the appropriate account name, and then click "Delete the account."

Windows XP now asks you if you want to preserve the contents of this person's My Documents folder. If you click the Keep Files button, you'll find a new folder, named for the dearly departed, on your desktop. (As noted in the dialog box, only the documents, contents of the desktop, and the My Documents folder are preservedbut not programs, email, or even Web favorites.) If that person ever returns to your life, you can create a new account for him and copy these files into the appropriate folder locations.

If you click the Delete Files button, on the other hand, the documents are gone forever.

A few more important points about deleting accounts:

You can't delete the account you're already using.
You can't delete the last Administrator account. One account must always remain .
You can create a new account with the same name and password as one that you deleted earlier, but in Windows XP's head, it's still not the same account.

As described in the box on Section 12.2.5, it won't have any of the original secondary passwords (for Web sites, shared folders, and so on).
Don't manipulate accounts manually (by fooling around in the Documents and Settings folder, for example). Create, delete, and rename them only using the User Accounts program in the Control Panel. Otherwise, you'll wind up with duplicate or triplicate folders in Documents and Settings, with the PC name tacked onto the end of the original account name (Bob, Bob.MILLEN-NIA, and so on)a sure recipe for confusion.