Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: How to deny access to Device manager in standard user account?

13 Sep 2016   #1
MataC

Windows 7 Ultimate x64
 
 
How to deny access to Device manager in standard user account?

Hi all!

I'm running Windows 7 Ultimate x64 and I want to completely deny access to Device manager in standard (default) user account.
As I understand, Standard user has basically all administrator rights, especially with an administrator password.
I already made a full administrator account. Can this be done?

Thank you in advance.


My System SpecsSystem Spec
.
13 Sep 2016   #2
cajuntiger

Windows 7 Ultimate x64
 
 

You can do that via group policy as admin.
My System SpecsSystem Spec
13 Sep 2016   #3
Brink

64-bit Windows 10 Pro
 
 

Hello MataC, and welcome to Seven Forums.

You could use OPTION TWO in the tutorial below to apply the group policy to the user or a group.

Device Manager MMC Snap-in - Enable or Disable
My System SpecsSystem Spec
.

13 Sep 2016   #4
Alejandro85

Windows 7 Ultimate x64
 
 

Quote   Quote: Originally Posted by MataC View Post
As I understand, Standard user has basically all administrator rights, especially with an administrator password.
No! Quite the opposite, the standard user exists to NOT to have any administrator right, that's the exact reason for them to exist in the first place. Normal users cannot do anything beyond their own profile folder, nothing system-wide can be affected by them (and attempts to do so will be greeted with an UAC prompt asking for a password or a plain access denied).

As for the "with an administrator password" part, as soon as you give an admin password to a person, he owns the machine. He can impersonate that admin account and use it to do whatever they want, no longer limited by their normal account. Of course if you want to restrict them to a standard user, you should never give them an admin password. Without that password, they're limited to their own account rights.

As for the question itself, standard users have read-only access to the device manager, they can view all the hardware, but cannot change anything. They'll be asked for administrator rights to do any modification. There is no need to do any change at all to the default system configuration to achieve that.
My System SpecsSystem Spec
14 Sep 2016   #5
MataC

Windows 7 Ultimate x64
 
 

Thank you all for your responses.

I'm talking about the default user account when you install Windows 7 which, as I understand, is called Standard user account (not Limited user) and it's not an administrator account either.
In my experience, under that account, I can change everything, including the Device manager, I just get a popup sometimes asking me if I want to make that certain change (I've turned that off).

What I want to do is just deny access to Device manager in that default account, nothing else, I could still change everything else; installations, files, folders etc.

Forgive my slight lack of understanding since Windows 7 has a bit tricky user account system...
My System SpecsSystem Spec
14 Sep 2016   #6
samuria

win 8 32 bit
 
 

If the account isn't admin then you wouldn't be able to do anything like installation change settings
My System SpecsSystem Spec
14 Sep 2016   #7
Brink

64-bit Windows 10 Pro
 
 

Quote   Quote: Originally Posted by MataC View Post
Thank you all for your responses.

I'm talking about the default user account when you install Windows 7 which, as I understand, is called Standard user account (not Limited user) and it's not an administrator account either.
In my experience, under that account, I can change everything, including the Device manager, I just get a popup sometimes asking me if I want to make that certain change (I've turned that off).

What I want to do is just deny access to Device manager in that default account, nothing else, I could still change everything else; installations, files, folders etc.

Forgive my slight lack of understanding since Windows 7 has a bit tricky user account system...
The account that you setup during Windows installation would be an administrator type of account.

Administrator accounts are an unelevated account that has complete access to the computer and can make any desired changes. Based on your UAC notification settings, administrators may be prompted to provide their password or confirmation before being allowed to open or run anything that requires elevated rights to do so, and make changes that affect the system or other users.
My System SpecsSystem Spec
14 Sep 2016   #8
LMiller7

Windows 7 Pro 64 bit
 
 

The account used by most home users is an admin account with the limitations imposed by UAC. By default this account has standard user rights with full admin rights available on request. You can't really restrict such an account. By design they have the exact same rights you do. Anyone with the knowledge readily available on the Internet can evade any restrictions you might put in place.

If you wish to restrict a user you must give them a standard user account with it's associated password and no others. They will be unable to make changes in Device manager, install or uninstall programs, or make any changes that effect other users. There is nothing a user with such an account can do to obtain admin rights. That is what a standard user account was created for and is being used for that purpose by many large corporations around the world. No system configuration changes are needed to accomplish this.

Of course if a user has access to the password of an admin level account they will have full access. It is up to you to ensure that doesn't happen.

Edit: for good security you should give the built in administrator account a good password and then disable it.
My System SpecsSystem Spec
14 Sep 2016   #9
Eric3742

Windows 7 x64
 
 

In summary.

For 1st user, after installation completed, this user do have admin rights.
By that meaning, it has the admin rights, but 1 level down from full Administrator access.

For how to bring this Administrator account

Built-in Administrator Account - Enable or Disable


The following is in my own opinion.

This Administrator access is hidden, by default.
You, as admin, can access to this full Administrator and with that power 100% it can do anything on your computer.
As for why it is not listed upon installation, it prevent malware and other virus to gain that level.
Once the malware gain that level, the malware can control you, your rights.
My System SpecsSystem Spec
16 Sep 2016   #10
MataC

Windows 7 Ultimate x64
 
 

Aha, so it's basically impossible to put any kind of restriction on the default Windows 7 account because its a 1 level down administrator account.

Is it possible then to allow limited/standard users to uninstall and install programs and change folders?
My System SpecsSystem Spec
Reply

 How to deny access to Device manager in standard user account?




Thread Tools Search this Thread
Search this Thread:

Advanced Search




Similar help and support threads
Thread Forum
Standard User Account - File/pgm access
I can't seem to simply create a second user who has no access to files/programs on the computer by default. From what I read, that's supposed to be the default behavior? When I try it, the new 'Standard user' account can see all programs and files. I haven't previously changed permissions or...
General Discussion
Wanting to create standard user and deny seeing main account's files.
Hello, I want to create a standard user and deny him seeing files on the main account on the computer. I am using windows 7. Basically one hard drive will have the main account(set to administrator) and another account for a friend to use(set to standard). I do not want the standard user...
General Discussion
How can a standard user gain access to an administrator account?
My Son And I Share A Laptop Running Windows 7 Home Edition , Am The Administrator And He Is The Standard User But He Keeps Going In And Changing My Account To Standard User And His To Administrator , Can Someone Tell Me How He Is Doing It And How Can I Put A Stop To It
General Discussion
Deny/Block Log Off Access to other users for a specific account
Hello I want another administrator account or any other account to NOT have log-off permissions to an administrator account. Forcefully. I do not want to block task manager or anything else, it's specifically log-off permissions, usually done through task manager. The Administrator account in...
General Discussion
Standard User Account Program Access
Hello All, I have set up a standard user account on my Son's laptop, but there are software programs I would like him to have access to, without me having to log on with Administrator ever time. When he try's to run said program it says Parental Controls has blocked this program the...
Performance & Maintenance
Task Manager - Allow or Deny Access Permission
Ok, first tutorial, so Im not 100% on making a tutorial :geek: This tutorial will show you how to enable or disable task manager for a certain user. Disable Access to Task Manager 1. Open windows explorer and navigate to C:\Windows\System32 2. Scroll down to taskmgr.exe. Right click...
Tutorials


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 12:00.

Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App