Local Users and Groups

Use Local Users and Groups to create and manage users and groups that are stored locally on a computer.

  • For tips about using Local Users and Groups, see Local Users and Groups best practices.

  • For help with specific tasks, see Local Users and Groups: How To....

  • For general background information, see Local Users and Groups: Concepts.

  • For problem-solving instructions, see Troubleshooting Local Users and Groups.

  • For information about the user interface, see User Interface: Local Users and Groups.


Local Users and Groups best practices

Best practices

  • As a security best practice, it is recommended that you do not log on to your computer with administrative credentials.

    When you are logged on to your computer without administrative credentials, you can use Run as Administrator to accomplish tasks that require a higher level of privilege than a standard user account. For more information, see Using Run as (http://go.microsoft.com/fwlink/?LinkId=28314).

  • To further secure your local computer, it is recommended that you implement the following security guidelines:

    • Limit the number of users in the Administrators group because members of the Administrators group on a local computer have Full Control permissions on that computer.

      For more information, see Why you should not run your computer as an administrator.

    • Leave the Guest account disabled. The Guest account is used by people who do not have an actual account on the computer. The Guest account does not require a password; therefore, it is a security risk. The Guest account is disabled by default, and it is recommended that it stay disabled.

      For more information, see Local user accounts.

    • Leave the Administrator account disabled. The Administrator account is disabled by default, and it is recommended that it stay disabled.

      For more information, see Local user accounts.

    • Some default user rights that are assigned to specific default local groups may allow members of those groups to gain additional rights on your computer, including administrative rights. Therefore, you must trust equally all personnel that are members of the Administrators and Backup Operators groups.

      For more information about these groups, see Default local groups.

    • Review important security considerations about local users and groups.

  • Use passwords no longer than 14 characters if you are on a network with computers running Windows 95 and Windows 98.

    You can create a password containing up to 127 characters. However, computers running Windows 95 and Windows 98 support passwords up to only 14 characters. If your password is longer than 14 characters, you may not be able to log on to the network from computers running Windows 95 and Windows 98.

    For more information, see Create a local user account.


Local Users and Groups: How To...

How to...

  • Run a program with administrative credentials

  • Manage Local Users

  • Manage Local Groups


Run a program with administrative credentials

To run a program with administrative credentials

  • In Windows Explorer, or on the Start menu, right-click the program executable file (or icon) that you want to open, and then click Run as Administrator.

Additional considerations

  • The use of Run as Administrator is not limited to administrator accounts.

  • You can use Run as Administrator to start a program in the context of an administrator account. The administrator context is used only for that specific program, and it is available only until that program is closed.

    For more information, see Using Run as (http://go.microsoft.com/fwlink/?LinkId=28314).

  • Some programs do not support Run as Administrator.

  • If Run as Administrator fails, the Application Information service may not be running.

Additional references

Troubleshooting Local Users and Groups

Why you should not run your computer as an administrator


Manage Local Users

Manage local users

  • Create a local user account

  • Reset the password for a local user account

  • Disable or activate a local user account

  • Delete a local user account

  • Rename a local user account

  • Assign a logon script to a local user account

  • Assign a home folder to a local user account


Create a local user account

Administrators is the minimum group membership required to complete this procedure. Review the details in "Additional considerations" in this topic.

To create a local user account

  1. Open Computer Management.

  2. In the console tree, click Users.

    Where?

    • Computer Management\System Tools\Local Users and Groups\Users

  3. On the Action menu, click New User.

  4. Type the appropriate information in the dialog box.

  5. Select or clear the check boxes for:

    • User must change password at next logon

    • User cannot change password

    • Password never expires

    • Account is disabled

  6. Click Create, and then click Close.

Additional considerations

  • To perform this procedure, you must provide credentials for the Administrator account on the local computer (if you are prompted), or you must be a member of the Administrators group on the local computer.

  • A user name cannot be identical to any other user name or group name on the computer that is being administered. The user name can contain up to 20 uppercase characters or lowercase characters, except for the following:

    " / \ [ ] : ; | = , + * ? < > @

    A user name cannot consist solely of periods (.) or spaces.

  • In Password and Confirm password, you can type a password containing up to 127 characters. However, if the network consists of computers running Windows 95 or Windows 98, consider using passwords that are no longer than 14 characters. If your password is longer than 14 characters, you may not be able to log on to the network from computers running Windows 95 or Windows 98.

  • The use of strong passwords and appropriate password policies can help protect your computer from attack.

Additional references

Local user accounts

Why you should not run your computer as an administrator

Assign a logon script to a local user account

Assign a home folder to a local user account


Reset the password for a local user account

Administrators is the minimum group membership required to complete this procedure. Review the details in "Additional considerations" in this topic.

To reset the password for a local user account

  1. Open Computer Management.

  2. In the console tree, click Users.

    Where?

    • Computer Management\System Tools\Local Users and Groups\Users

  3. Right-click the user account for which you want to reset the password, and then click Set Password.

  4. Read the warning message, and if you want to continue, click Proceed.

  5. In New password and in Confirm password, type a new password, and then click OK.

Additional considerations

  • To perform this procedure, you must provide credentials for the Administrator account on the local computer (if you are prompted), or you must be a member of the Administrators group on the local computer.

  • Strong passwords improve computer and network security.

  • Resetting a local account password for a user may result in some data loss for that user if the user has encrypted data or alternate Internet passwords.

Additional references

Local Users and Groups best practices

Set Password for <User> Dialog Box - Help


Disable or activate a local user account

Administrators is the minimum group membership required to complete this procedure. Review the details in "Additional considerations" in this topic.

To disable or activate a local user account

  1. Open Computer Management.

  2. In the console tree, click Users.

    Where?

    • Computer Management\System Tools\Local Users and Groups\Users

  3. Right-click the user account that you want to change, and then click Properties.

  4. Do one of the following:

    • To disable the selected user account, select the Account is disabled check box.

    • To activate the selected user account, clear the Account is disabled check box.

Additional considerations

  • To perform this procedure, you must provide credentials for the Administrator account on the local computer (if you are prompted), or you must be a member of the Administrators group on the local computer.

  • When a user account is disabled, the user is not permitted to log on. The account appears in the details pane with an X on the icon.

  • Before you activate a disabled account, make sure that the account was not locked out for security reasons.

  • When a user account is activated, the user is permitted to log on normally.

Additional references

Local Users and Groups best practices

Local user accounts


Delete a local user account

Administrators is the minimum group membership required to complete this procedure. Review the details in "Additional considerations" in this topic.

To delete a local user account

  1. Open Computer Management.

  2. In the console tree, click Users.

    Where?

    • Computer Management\System Tools\Local Users and Groups\Users

  3. Right-click the user account that you want to delete, and then click Delete.

Additional considerations

  • To perform this procedure, you must provide credentials for the Administrator account on the local computer (if you are prompted), or you must be a member of the Administrators group on the local computer.

  • When you need to delete a user account, it is recommended that you first disable the account. When you are certain that disabling the account has not caused a problem, you can safely delete the account.

  • A deleted user account cannot be recovered.

  • The Administrator account and the Guest account cannot be deleted.

Additional references

Local user accounts

Disable or activate a local user account


Rename a local user account

Administrators is the minimum group membership required to complete this procedure. Review the details in "Additional considerations" in this topic.

To rename a local user account

  1. Open Computer Management.

  2. In the console tree, click Users.

    Where?

    • Computer Management\System Tools\Local Users and Groups\Users

  3. Right-click the user account that you want to rename, and then click Rename.

  4. Type the new user name, and then press ENTER.

Additional considerations

  • To perform this procedure, you must provide credentials for the Administrator account on the local computer (if you are prompted), or you must be a member of the Administrators group on the local computer.

  • Because it retains its security identifier (SID), a renamed user account retains all its other properties, such as its description, password, group memberships, user profile, account information, and any assigned permissions and user rights.

  • A user name cannot be identical to any other user name or group name of the computer that is being administered. A user name can contain up to 20 uppercase characters or lowercase characters, except for the following:

    " / \ [ ] : ; | = , + * ? < > @

    A user name cannot consist solely of periods (.) or spaces.

Additional references

Local user accounts

Assign a logon script to a local user account

Assign a home folder to a local user account


Assign a logon script to a local user account

Administrators is the minimum group membership required to complete this procedure. Review the details in "Additional considerations" in this topic.

To assign a logon script to a local user account

  1. Open Computer Management.

  2. In the console tree, click Users.

    Where?

    • Computer Management\System Tools\Local Users and Groups\Users

  3. Right-click the user account that you want, and then click Properties.

  4. On the Profile tab, in Logon script, type the file name and relative path of the script.

Additional considerations

  • To perform this procedure, you must provide credentials for the Administrator account on the local computer (if you are prompted), or you must be a member of the Administrators group on the local computer.

  • Logon scripts can contain malicious commands. It is recommended that you be familiar with the contents of a logon script before you assign it to a user.

  • Logon scripts that are stored on a local computer apply only to users who log on to that local computer.

  • Local logon scripts must be stored in a shared folder — or subfolders of the shared folder — named Netlogon. If this folder does not exist by default, you must create it. To specify a logon script that is stored in a subfolder of the Netlogon folder, precede the file name with the relative path to that folder. For example, to assign the Startup.bat logon script that is stored in \\ComputerName\Netlogon\FolderName to a local user, in Logon script type FolderName\Startup.bat

Additional references

Assign a home folder to a local user account

Add a member to a local group


Assign a home folder to a local user account

Administrators is the minimum group membership required to complete this procedure. Review the details in "Additional considerations" in this topic.

To assign a home folder to a local user account

  1. Open Computer Management.

  2. In the console tree, click Users.

    Where?

    • Computer Management\System Tools\Local Users and Groups\Users

  3. Right-click the user account for which you want to specify a home folder, and then click Properties.

  4. On the Profile tab, do one of the following:

    • To specify a local home folder, click Local path, and then type the path, for example, c:\users\maria.

    • To specify a home folder on a shared resource, click Connect, click the proper drive letter, and then type the network path, for example, \\airedale\users\andreas.

Additional considerations

  • To perform this procedure, you must provide credentials for the Administrator account on the local computer (if you are prompted), or you must be a member of the Administrators group on the local computer.

  • The Documents folder provides a convenient alternative to home folders, but it does not replace them. Each user has a Documents folder on the boot volume.

  • If no home folder is assigned, the system assigns a default local home folder to the user account (on the root directory where the operating system files are installed as the initial version).

  • To specify a network path for the home folder, you must first create the shared resource and set permissions that allow the user access.

Additional references

Managing files for local user accounts

Assign a logon script to a local user account

Add a member to a local group


Manage Local Groups

Manage local groups

  • Create a local group

  • Add a member to a local group

  • Identify members of a local group

  • Delete a local group


Create a local group

Administrators is the minimum group membership required to complete this procedure. Review the details in "Additional considerations" in this topic.

Creating a local group

  • Using the Windows interface

  • Using a command line

To create a local group using the Windows interface

  1. Open Computer Management.

  2. In the console tree, click Groups.

    Where?

    • Computer Management\System Tools\Local Users and Groups\Groups

  3. On the Action menu, click New Group.

  4. In Group name, type a name for the new group.

  5. In Description, type a description of the new group.

  6. To add one or more members to the new group, click Add.

  7. In the Select Users, Computers, or Groups dialog box, do the following:

    • To add a user or group account to this group, under Enter the object names to select, type the name of the user account or group account that you want to add, and then click OK.

    • To add a computer account to this group, click Object Types, select the Computers check box, and then click OK. Under Enter the object names to select, type the name of the computer account that you want to add, and then click OK.

  8. In the New Group dialog box, click Create, and then click Close.

Additional considerations

  • To perform this procedure, you must provide credentials for the Administrator account on the local computer (if you are prompted), or you must be a member of the Administrators group on the local computer.

  • A local group name cannot be identical to any other group name or user name on the local computer that is being administered. The local group name can contain up to 256 uppercase characters or lowercase characters, except for the following:

    " / \ [ ] : ; | = , + * ? < > @

    A group name cannot consist solely of periods (.) or spaces.

To create a local group by using a command line

  1. Open Command Prompt.

  2. To create a group, type:

    net localgroup <GroupName> /add

Additional considerations

  • To perform this procedure, you must provide credentials for the Administrator account on the local computer (if you are prompted), or you must be a member of the Administrators group on the local computer.

  • A local group name cannot be identical to any other group or user name on the local computer that is being administered. The local group name can contain up to 256 uppercase or lowercase characters, except for the following:

    " / \ [ ] : ; | = , + * ? < > @

    A group name cannot consist solely of periods (.) or spaces.

  • For more information about the net localgroup command, see Managing local groups from the command line.

Additional references

Default local groups

Add a member to a local group

Command-line syntax notation


Add a member to a local group

Administrators is the minimum group membership required to complete this procedure. Review the details in "Additional considerations" in this topic.

Adding a member to a local group

  • Using the Windows interface

  • Using a command line

To add a member to a local group using the Windows interface

  1. Open Computer Management.

  2. In the console tree, click Groups.

    Where?

    • Computer Management\System Tools\Local Users and Groups\Groups

  3. Right-click the group to which you want to add a member, click Add to Group, and then click Add.

  4. In the Select Users, Computers, or Groups dialog box, do the following:

    • To add a user account or group account to this group, under Enter the object names to select, type the name of the user account or group account that you want to add to the group, and then click OK.

    • To add a computer account to this group, click Object Types, select the Computers check box, and then click OK. Under Enter the object names to select, type the name of the computer account that you want to add to the group, and then click OK.

Additional considerations

  • To perform this procedure, you must provide credentials for the Administrator account on the local computer (if you are prompted), or you must be a member of the Administrators group on the local computer.

  • To remove a member from a local group, select the user account, computer account, or group account in Members, and then click Remove.

  • All the rights and permissions that are assigned to a group are assigned to all members of that group.

  • Limit the number of users in the Administrators group. Members of the Administrators group on a local computer have Full Control permissions on that computer.

  • If the computer is joined to a domain, you can add user accounts, computer accounts, and group accounts from that domain and from trusted domains to a local group.

To add a member to a local group using a command line

  1. Open Command Prompt.

  2. To add a member to the Backup Operators group, type:

    net localgroup "Backup Operators" "<MemberName>" /add

    You must include the quotation marks.

Additional considerations

  • To perform this procedure, you must provide credentials for the Administrator account on the local computer (if you are prompted), or you must be a member of the Administrators group on the local computer.

  • All the rights and permissions that are assigned to a group are assigned to all members of that group.

  • Limit the number of users in the Administrators group. Members of the Administrators group on a local computer have Full Control permissions on that computer.

  • If the computer is joined to a domain, you can add user accounts, computer accounts, and group accounts from that domain and from trusted domains to a local group.

Additional references

Default local groups

Why you should not run your computer as an administrator

Managing local groups from the command line

Command-line syntax notation


Identify members of a local group

No minimum group membership is required to complete this procedure. Review the details in "Additional considerations" in this topic.

Identifying members of a local group

  • Using the Windows interface

  • Using a command line

To identify members of a local group using the Windows interface

  1. Open Computer Management.

  2. In the console tree, click Groups.

    Where?

    • Computer Management/System Tools/Local Users and Groups/Groups

  3. Right-click the group in which you want to identify members, and then click Properties.

Additional considerations

  • You do not need administrative credentials to perform this procedure.

To identify members of a local group by using a command line

  1. Open Command Prompt.

  2. To list members of the Backup Operators group, type:

    net localgroup "Backup Operators"

    You must include the quotation marks.

Additional considerations

  • You do not need administrative credentials to perform this procedure.

  • For more information about the net localgroup command, see Managing local groups from the command line.

Additional references

Default local groups


Delete a local group

Administrators is the minimum group membership required to complete this procedure. Review the details in "Additional considerations" in this topic.

Deleting a local group

  • Using the Windows interface

  • Using a command line

To delete a local group using the Windows interface

  1. Open Computer Management.

  2. In the console tree, click Groups.

    Where?

    • Computer Management\System Tools\Local Users and Groups\Groups

  3. Right-click the group that you want to delete, and then click Delete.

Additional considerations

  • To perform this procedure, you must provide credentials for the Administrator account on the local computer (if you are prompted), or you must be a member of the Administrators group on the local computer.

  • The following default groups cannot be deleted:

    • Administrators

    • Backup Operators

    • Cryptographic Operators

    • Distributed COM Users

    • Guests

    • IIS_IUSRS

    • Network Configuration Operators

    • Performance Log Users

    • Performance Monitor Users

    • Power Users

    • Remote Desktop Users

    • Replicator

    • Users

  • A deleted group cannot be recovered.

  • Deleting a local group removes only the group. It does not delete the user accounts, computer accounts, or group accounts that were members of that group.

  • If you delete a group and then create another group with the same group name, you must set new permissions for the new group. The new group will not inherit the permissions that were assigned to the old group.

To delete a local group using a command line

  1. Open Command Prompt.

  2. To delete a group, type:

    net localgroup <GroupName> /delete

Additional considerations

  • To perform this procedure, you must provide credentials for the Administrator account on the local computer (if you are prompted), or you must be a member of the Administrators group on the local computer.

  • The following default groups cannot be deleted:

    • Administrators

    • Backup Operators

    • Cryptographic Operators

    • Distributed COM Users

    • Guests

    • IIS_IUSRS

    • Network Configuration Operators

    • Performance Log Users

    • Performance Monitor Users

    • Power Users

    • Remote Desktop Users

    • Replicator

    • Users

  • A deleted group cannot be recovered.

  • Deleting a local group removes only the group. It does not delete the user accounts, computer accounts, or group accounts that were members of that group.

  • If you delete a group and then create another group with the same group name, you must set new permissions for the new group. The new group will not inherit the permissions that were granted to the old group.

  • For more information about the net localgroup command, see Managing local groups from the command line.

Additional references

Default local groups

Delete a local user account

Command-line syntax notation


Local Users and Groups: Concepts

Concepts

This section provides general background information about Local Users and Groups:

  • Understanding Local Users and Groups

  • Administering Local Users and Groups


Understanding Local Users and Groups

Understanding Local Users and Groups

This section covers:

  • Local Users and Groups overview

  • Local user accounts

  • Default local groups


Local Users and Groups overview

Local Users and Groups overview

Local Users and Groups is located in Computer Management, a collection of administrative tools that you can use to manage a single local computer or remote computer. You can use Local Users and Groups to secure and manage user accounts and groups that are stored locally on your computer. You can assign permissions and rights to a local user account or group account on a particular computer (and only that computer).

By using Local Users and Groups, you can limit the ability of users and groups to perform certain actions by assigning rights and permissions to them. A right authorizes a user to perform certain actions on a computer, such as backing up files and folders or shutting down a computer. A permission is a rule that is associated with an object (usually a file, folder, or printer), and it regulates which users can have access to the object and in what manner.

For more information, see:

  • Local user accounts

  • Default local groups


Local user accounts

Local user accounts

The Users folder, which is located in the Local Users and Groups Microsoft Management Console (MMC) snap-in, displays default user accounts as well as the user accounts that you create. These default user accounts are created automatically when you install the operating system. The following table describes each default user account that appears in Local Users and Groups.

Default user account Description

Administrator account

The Administrator account is disabled by default, but you can enable it. When it is enabled, the Administrator account has full control of the computer, and it can assign user rights and access control permissions to users as necessary. This account must be used only for tasks that require administrative credentials. It is highly recommended that you set up this account to use a strong password. For additional security considerations for accounts with administrative credentials, see Local Users and Groups best practices.

The Administrator account is a member of the Administrators group on the computer. The Administrator account can never be deleted or removed from the Administrators group, but it can be renamed or disabled. Because the Administrator account is known to exist on many versions of Windows, renaming or disabling this account will make it more difficult for malicious users to try and gain access to it. For more information about how to rename or disable a user account, see Rename a local user account and Disable or activate a local user account.

Important

Even when the Administrator account has been disabled, it can still be used to gain access to a computer through Safe Mode.

Guest account

The Guest account is used by people who do not have an actual account on the computer. A user whose account is disabled, but not deleted, can also use the Guest account. The Guest account does not require a password. The Guest account is disabled by default, but you can enable it.

You can set rights and permissions for the Guest account just like any user account. By default, the Guest account is a member of the default Guests group, which allows a user to log on to a computer. Additional rights, as well as any permissions, must be granted to the Guests group by a member of the Administrators group. The Guest account is disabled by default, and it is recommended that it stay disabled.

For more information about creating and managing local user accounts, see Manage Local Users.


Default local groups

Default local groups

The Groups folder, which is located in the Local Users and Groups Microsoft Management Console (MMC) snap-in, displays the default local groups as well as the local groups that you create. Default local groups are created automatically when you install the operating system. Belonging to a local group gives a user the rights and abilities to perform various tasks on the local computer.

You can add local user accounts, domain user accounts, computer accounts, and group accounts to local groups. For more information about adding members to local groups, see Add a member to a local group.

Note

If you want to learn what group you need to be a member of to perform a particular procedure, many procedure topics under Local Users and Groups: How To... provide a note that identifies this information.

The following table provides descriptions of the default groups that are located in the Groups folder. The table also lists the default user rights for each group. These user rights are assigned in the local security policy.

Group Description Default user rights

Administrators

Members of this group have full control of the computer, and they can assign user rights and access control permissions to users as necessary. The Administrator account is a default member of this group. When a computer is joined to a domain, the Domain Admins group is added to this group automatically. Because this group has full control of the computer, use caution when you add users to it.
  • Access this computer from the network

  • Adjust memory quotas for a process

  • Allow logon locally

  • Allow logon through Terminal Services

  • Back up files and directories

  • Bypass traverse checking

  • Change the system time

  • Change the time zone

  • Create a page file

  • Create global objects

  • Create symbolic links

  • Debug programs

  • Force shutdown from a remote system

  • Impersonate a client after authentication

  • Increase scheduling priority

  • Load and unload device drivers

  • Log on as a batch job

  • Manage auditing and security log

  • Modify firmware environment variables

  • Perform volume maintenance tasks

  • Profile single process

  • Profile system performance

  • Remove computer from docking station

  • Restore files and directories

  • Shut down the system

  • Take ownership of files or other objects

Backup Operators

Members of this group can back up and restore files on a computer, regardless of any permissions that protect those files. This is because the right to perform a backup takes precedence over all file permissions. Members of this group cannot change security settings.
  • Access this computer from the network

  • Allow logon locally

  • Back up files and directories

  • Bypass traverse checking

  • Log on as a batch job

  • Restore files and directories

  • Shut down the system

Cryptographic Operators

Members of this group are authorized to perform cryptographic operations.
  • No default user rights

Distributed COM Users

Members of this group are allowed to start, activate, and use DCOM objects on a computer.
  • No default user rights

Guests

Members of this group have a temporary profile created at log on, and when the member logs off, the profile is deleted. The Guest account (which is disabled by default) is also a default member of this group.
  • No default user rights

IIS_IUSRS

This is a built-in group that is used by Internet Information Services (IIS).
  • No default user rights

Network Configuration Operators

Members of this group can make changes to TCP/IP settings, and they can renew and release TCP/IP addresses. This group has no default members.
  • No default user rights

Performance Log Users

Members of this group can manage performance counters, logs, and alerts on a computer — both locally and from remote clients — without being a member of the Administrators group.
  • No default user rights

Performance Monitor Users

Members of this group can monitor performance counters on a computer — locally and from remote clients — without being a member of the Administrators group or the Performance Log Users groups
  • No default user rights

Power Users

By default, members of this group have no more user rights or permissions than a standard user account. The Power Users group in previous versions of Windows was designed to give users specific administrator rights and permissions to perform common system tasks. In this version of Windows, standard user accounts inherently have the ability to perform most common configuration tasks, such as changing time zones. For legacy applications that require the same Power User rights and permissions that were present in previous versions of Windows, administrators can apply a security template that enables the Power Users group to assume the same rights and permissions that were present in previous versions of Windows.
  • No default user rights

Remote Desktop Users

Members of this group can log on to the computer remotely.
  • Allow logon through Terminal Services

Replicator

This group supports replication functions. The only member of the Replicator group should be a domain user account that is used to log on the Replicator services of a domain controller. Do not add user accounts of actual users to this group.
  • No default user rights

Users

Members of this group can perform common tasks, such as running applications, using local and network printers, and locking the computer. Members of this group cannot share directories or create local printers. By default, the Domain Users, Authenticated Users, and Interactive groups are members of this group. Therefore, any user account that is created in the domain becomes a member of this group.
  • Access this computer from the network

  • Allow logon locally

  • Bypass traverse checking

  • Change the time zone

  • Increase a process working set

  • Remove the computer from a docking station

  • Shut down the system

Offer Remote Assistance Helpers

Members of this group can offer Remote Assistance to the users of this computer.
  • No default user rights


Administering Local Users and Groups

Administering Local Users and Groups

This section covers:

  • Managing files for local user accounts

  • Managing local groups from the command line

  • Why you should not run your computer as an administrator

  • User Account Control Overview


Managing files for local user accounts

Managing files for local user accounts

Administrators can use home folders and the Documents folder to collect user files in one location. The location of user files in one place simplifies the backup process and makes access control management easier.

A home folder can be a local folder or a folder that is located on a shared resource. It can be assigned to a single user or to many users. When a home folder is assigned to a user, it becomes the user's default folder for the Open and Save As dialog boxes, command-prompt sessions, and all programs that do not have a defined working folder.

The Documents folder is an alternative for home folders, but it does not replace them. When a user tries to save or open a file, most programs determine whether to use the home folder or the Documents folder in one of two ways:

  • Some programs look first in the home folder for files that match the type of file that is to be opened or saved, for example, *.doc or *.txt. If a file with a matching extension is found, the program opens the home folder and ignores the Documents folder. If a file with a matching extension is not found, the program opens the Documents folder.

  • In other programs, the home folder is ignored, regardless of whether the home folder contains any files.

For more information about how to assign home folders, see Assign a home folder to a local user account.


Managing local groups from the command line

Managing local groups from the command line

You can use the command-line tool in the following table to manage local groups.

Name | Description
net localgroup | This command adds, displays, or modifies local groups.

For information about net localgroup, see Command-line reference A-Z (http://go.microsoft.com/fwlink/?LinkId=20331). Click N, click Net services commands, and then click Net localgroup.

Additional command-line tools are available in the Support tools folder of the product CD.


Why you should not run your computer as an administrator

Why you should not run your computer as an administrator

Running your computer as a member of the Administrators group makes the system vulnerable to Trojan horses and other security risks. The simple act of visiting an Internet site or opening an e-mail attachment can be damaging to the system. An unfamiliar Internet site or e-mail attachment may have Trojan horse code that can be downloaded to the system and executed.

If you are logged on as an administrator of a local computer, a Trojan horse could reformat your hard drive, delete your files, and create a new user account with administrative access.

On a local computer, it is recommended that you add your domain user account only to the Users group (and not to the Administrators group) to perform routine tasks, including running programs and visiting Internet sites. When it becomes necessary to perform administrative tasks on the local computer, use Run as Administrator to start a program using administrative credentials.

You can use Run as Administrator to accomplish administrative tasks without exposing your computer to unnecessary risk. For more information, see Using Run as (http://go.microsoft.com/fwlink/?LinkId=28314).

For more information about how to use Run as Administrator, see Run a program with administrative credentials.

If you need to perform other administrative tasks, such as upgrading the operating system or configuring system parameters, log off and then log back on as an administrator.


User Account Control Overview

User Account Control (UAC) is a new security component of the Microsoft® Windows Vista® and Windows Server® 2008 operating systems. UAC enables users to perform common tasks as nonadministrators—who are called "standard users" in this version of Windows—and as administrators, without having to switch users, log off, or use the Run as administrator command. A standard user account is similar to a user account in Microsoft Windows® XP. User accounts that are members of the local Administrators group run most applications as a standard user. Because it separates user functions and administrator functions while enabling productivity, UAC is an important enhancement for this version of Windows.

When an administrator logs on to a Windows Vista or Windows Server 2008 computer, the user is assigned two separate access tokens. Windows uses access tokens, which contain a user's group membership, authorization data, and access control data, to control what resources and tasks the user can access. In previous versions of Windows, an administrator account received one access token, which included data to grant the user access to all Windows resources. This access control model did not include any fail-safe checks to make sure that the user truly wanted to perform a task that required his or her administrative access token. As a result, malicious software could install itself on a computer without notifying the user. This process is commonly referred to as "silent" installation. Because the user was an administrator, the malicious software could use the administrator's access control data to infect core operating system files. In some situations, the malicious software could become nearly impossible to remove, and it could cause even more damage.

The primary difference between a standard user and an administrator in this version of Windows is how much control they have over the computer. Administrators can change system state, turn off the firewall, turn off policy, install a service or a driver that affects every user on the computer, and so on. Administrators can install software for an entire computer. Standard users cannot change system state in this manner.

For more information about UAC, see Help and Support.


Troubleshooting Local Users and Groups

Troubleshooting

What problem are you having?

  • I received the "The local policy of this system does not permit you to logon interactively" error message, or I am unable to log on locally.

  • The runas command failed.

  • I cannot log on to a network computer running Windows 95 or Windows 98.

  • I cannot access the Computer Management extension snap-ins on a remote computer.
I received the "The local policy of this system does not permit you to logon interactively" error message, or I am unable to log on locally.

Cause: The ability to log on locally to a computer is controlled by local security policy.

Solution: Add the user account to the Users local group, or use the local security policy to assign the particular user or group the Allow log on locally right.

The runas command failed.

Cause: The Secondary Logon service is not running.

Solution: Start the Secondary Logon service.

For more information about the runas command, see Using Run as (http://go.microsoft.com/fwlink/?LinkId=28314).

I cannot log on to a network computer running Windows 95 or Windows 98.

Cause: Your password is longer than 14 characters.

Solution: Create a new user account or change your password to the 14-character maximum for Windows 95 and Windows 98.

I cannot access the Computer Management extension snap-ins on a remote computer.

Cause: The Remote Registry service is not running on the remote computer.

Solution: Ensure that the Remote Registry service is started on the remote computer. You need appropriate permissions on the remote computer to start the service.

Note

You might also receive this error message if the remote computer is running Windows 95. Computer Management does not support remote access to computers that are running Windows 95.


User Interface: Local Users and Groups

  • <User> Properties Sheet - General

  • <User> Properties Sheet - Member Of

  • <User> Properties Sheet - Profile

  • Set Password for <User> Dialog Box - Help

  • Set Password for <User> Dialog Box

  • New User Dialog Box

  • New Group Dialog Box

  • <Group> Properties Sheet


<User> Properties Sheet - General

<User> Properties Sheet - General

Item Details

Full name

Provides a space for you to type the user's complete name. It is a good idea to establish a standard for full names so that they always begin with either the first name (Kevin F. Browne) or the last name (Browne, Kevin F.).

Description

Provides a space for you to type any text that describes the user account or the user.

User must change password at next logon check box

Specifies whether the user must change the password at the next logon.

User cannot change password check box

Specifies whether the user cannot change the assigned password. This option is usually selected only for accounts that are used by more than one person, such as the Guest account. This setting has no effect on members of the Administrators group.

Password never expires check box

Specifies whether the password will never expire, and overrides the Maximum Password Age setting in the Password policy in Group Policy. Select this option when you assign services, such as Directory Replicator, using Services. This setting overrides User must change password at next logon.

Account is disabled check box

Specifies whether the selected account is disabled.

Account is locked out check box

Indicates whether the account is locked out, which means that the user is not able to log on.

If the check box is unavailable and cleared, the account is not currently locked out.

If this check box is available and selected, the account is currently locked out. You can clear the check box to unlock the account.

You cannot use this option to actually lock out an account. There is only one way that an account can be locked out: the user tries to log on more than the number of times that are specified in the Password policy setting in Group Policy. If you want to prevent the use of an account, disable it. A user whose account has been disabled cannot log on until a member of the Administrators group enables the account.

Additional references

Local user accounts

Create a local user account

Disable or activate a local user account


<User> Properties Sheet - Member Of

<User> Properties Sheet - Member Of

Item | Details
Member of | Lists the groups that the user account is a member of.
Add | Click to select the group that you want to add this user account to.
Remove | Removes the user from the selected group.

Additional references

Local user accounts

Add a member to a local group


<User> Properties Sheet - Profile

<User> Properties Sheet - Profile

Item Details

Profile path

Provides a space for you to type a user profile path to the user account.

To enable a roaming or mandatory user profile for the selected user account, type a network path in the form \\server name\profiles folder name\user name, for example, \\puma\profiles\davidp.

To assign a mandatory user profile, type a network path in the form \\server name\profiles folder name\user profile name, for example, \\puma\profiles\clerks.

To assign a mandatory user profile, you must also copy a preconfigured user profile to the location that you specify in this space.

Logon script

Provides a space for you to type the name of a logon script. If the logon script is located in a subdirectory of the default logon script path, precede the file name with that relative path.

For example, to specify the Startup.bat logon script that is stored in \\ComputerName\Netlogon\FolderName, type FolderName\Startup.bat.

Local path

Specifies a local path as the home folder. Type a local path, for example, c:\users\rajeshp.

Connect

Specifies a shared network directory as the home folder for this user. Select a drive letter in the menu.

To

Provides a space for you to type the network path for this user's home folder. For example, you might specify drive J, and then type \\airedale\users\dorenap.

Additional references

Local user accounts

Assign a logon script to a local user account

Assign a home folder to a local user account

Managing files for local user accounts


Set Password for <User> Dialog Box - Help

To keep protected information secure, after a password is reset on a local user account, some types of information are no longer accessible, including the following:

  • E-mail that is encrypted with the user's public key

  • Internet passwords that are saved on the computer

  • Files that the user has encrypted

If you want to avoid this type of data loss, do not reset a user's password. When you create a new local user account, have the user create a password reset disk. Then, if the user forgets the password, the password reset disk can be used to reset the password without data loss. If a user forgets the password to a domain user account, the password must be reset manually.

For more information about what you should know before you reset a password, search Help and Support for the topic "What are the risks of resetting a password?"


Set Password for <User> Dialog Box

Set Password for <User> Dialog Box

Item | Details
New password | Provides a space for you to type a password with up to 14 characters. Passwords are case sensitive.
Confirm password | Provides a space for you to type the password again to confirm it.

Additional references

Reset the password for a local user account


New User Dialog Box

New User Dialog Box

Item | Details
User name | Provides a space for you to type a name to identify the user account. A user name cannot be identical to any other user name or group name on the computer being administered. A user name can contain up to 20 uppercase characters or lowercase characters except for the following: " / \ [ ] : ; | = , + * ? < > @ A user name cannot consist solely of periods (.) or spaces.
Full name | Provides a space for you to type the user's complete name. It is a good idea to establish a standard for full names so that they always begin with either the first name (Kevin F. Browne) or the last name (Browne, Kevin F.).
Description | Provides a space for you to type any text that describes the user account or the user.
Password | Provides a space for you to type a password with up to 14 characters. Passwords are case sensitive.
Confirm password | Provides a space for you to type the password again to confirm it.
User must change password at next logon check box | Specifies whether the user must change the password at the next logon.
User cannot change password check box | Specifies whether the user cannot change the assigned password. This option is usually selected only for accounts that are used by more than one person, such as the Guest account. This setting has no effect on members of the Administrators group.
Password never expires check box | Specifies whether the password will never expire, and overrides the Maximum Password Age setting in the Password policy in Group Policy. Select this option when you assign services, such as Directory Replicator, using Services. This setting overrides User must change password at next logon.
Account is disabled check box | Specifies whether the selected account is disabled.

Additional references

Local user accounts

Create a local user account

Disable or activate a local user account


New Group Dialog Box

New Group Dialog Box

Item | Details
Group name | Provides a space for you to type a name that identifies the local group. A local group name cannot be identical to any other group name or user name on the computer. A group name can contain up to 256 uppercase characters or lowercase characters except for the following: " / \ [ ] : ; | = , + * ? < > @ A group name cannot consist solely of periods (.) or spaces.
Description | Provides a space for you to type a description of the group account.
Members | Lists the members of the local group. User accounts from this computer can be members of the local group. If this computer participates in a domain, user accounts and global groups from the local domain and trusted domains can also be members of the local group.
Add | Click to add user accounts or global groups to the local group.
Remove | Removes the selected user account or global group from the selected local group.

Additional references

Create a local group

Default local groups

Add a member to a local group

Managing local groups from the command line


<Group> Properties Sheet

<Group> Properties Sheet

Item | Details
Description | Provides a space for you to type a description of the group account.
Members | Lists the members of the local group. User accounts from this computer can be members of the local group. If this computer participates in a domain, user accounts and global groups from the local domain and trusted domains can also be members of the local group.
Add | Click to add user accounts or global groups to the local group.
Remove | Removes the selected user account or global group from the selected local group.

Additional references

Default local groups

Add a member to a local group

Managing local groups from the command line


Command-line syntax notation

The following table describes the notation used to indicate command-line syntax.

Notation | Description
Text without brackets or braces | Items you must type as shown
<Text inside angle brackets> | Placeholder for which you must supply a value
[Text inside square brackets] | Optional items
{Text inside braces} | Set of required items; choose one
Vertical bar (|) | Separator for mutually exclusive items; choose one
Ellipsis (…) | Items that can be repeated