Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: How to place restrictions on standard user accounts beyond parentals

05 Jul 2010   #1
nicholas8814

Windows 7 64 bit
 
 
How to place restrictions on standard user accounts beyond parentals

I am trying to deny permission on standard user accounts to download files from email and such, as well ensure they cannot execute files. I cannot find this option available under parental controls, or even in additional parental controls software. Could someone please advise me how to gain greater control over standard user permissions?

Thank you,
Nick


My System SpecsSystem Spec
.

05 Jul 2010   #2
gregrocker
Microsoft MVP

 
 

You want to operate as passworded Administrator, then create standard User account for others to use.

Test this standard account on the operations you want to restrict first and make a list of the ones which aren't restrictive enough, then post back or Google how to restrict each.

Title your post the exact function you want to restrict to get catch the attention of someone who knows the specific answer. Google probably already knows if you ask succinctly enough.

I believe this still applies with WIn7 to restrict file access: How to Deny Access to Files or Folders in Windows Vista - How-To Geek
My System SpecsSystem Spec
05 Jul 2010   #3
nicholas8814

Windows 7 64 bit
 
 

I think i understand that process, however I am unable to set myself as owner privileged. I am signed in on admin account, but it will not allow me to take ownership over the local disk, even though there is no account set as the owner.
My System SpecsSystem Spec
.


05 Jul 2010   #4
JonM33

Windows 7 Home Premium x64
 
 

Quote   Quote: Originally Posted by gregrocker View Post
You want to operate as passworded Administrator, then create standard User account for others to use.

Test this standard account on the operations/files you want to restrict first and make a list of the ones which aren't restrictive enough, then post back or Google how to restrict each.

Title your post the exact function you want to restrict to get catch the attention of someone who knows the specific answer. Google probably already knows if you ask succinctly enough.

I believe this still applies with WIn7 to restrict file access: How to Deny Access to Files or Folders in Windows Vista - How-To Geek
That is actually VERY bad advice, even for HTG (which I am a member of). Never use the "Deny" setting on NTFS permissions. It is the worst practice you can ever make.

You can actually use Group Policy, which is MUCH safer. Given, you will need at least Windows 7 Pro or better as Group Policy is not available on any Home edition.

With the Parental Controls you can restrict that they can only execute certain applications. They will be prevented from executing anything else.
My System SpecsSystem Spec
05 Jul 2010   #5
gregrocker
Microsoft MVP

 
 

Please explain how restricting file access using the OS's own permissions utility is a "worst practice."

Was all of my post "VERY bad advice" or just using the permissions which are placed on each folder and file for the specific purpose of being able to restrict their access?

Since Group policy is not available on lesser versions than Pro and there is about an 80% chance they have Home Premium, how would you have OP restrict access to folders they don't want shared?
My System SpecsSystem Spec
05 Jul 2010   #6
JonM33

Windows 7 Home Premium x64
 
 

Quote   Quote: Originally Posted by gregrocker View Post
Please explain how restricting file access using the OS's own permissions utility is a "worst practice."

Was all of my post "VERY bad advice" or just using the permissions which are placed on each folder and file for the specific purpose of being able to restrict their access?

Since Group policy is not available on lesser versions than Pro and there is an 80% chance they have Home Premium, how would you have OP restrict access to folders they don't want shared?
There are good practices and bad ones with setting NTFS permissions. It is better to remove a group and restrict a folder to a user than to ever use "Deny". If you make that user with "Deny" NTFS permission on their own user folder they will not be able to log in.

Besides, the OP merely wants to prevent someone from downloading a file and executing it. As far as executing the file, you can do that by making that person a separate account and making it a Standard user. They won't be able to install anything at that point. You can then use Parental Controls to restrict them to only execute certain applications.

Regarding downloading files, that can only be done through Group Policy or the registry.
My System SpecsSystem Spec
05 Jul 2010   #7
gregrocker
Microsoft MVP

 
 

Quote   Quote: Originally Posted by JonM33 View Post
Besides, the OP merely wants to prevent someone from downloading a file and executing it. As far as executing the file, you can do that by making that person a separate account and making it a Standard user. They won't be able to install anything at that point. .
From my original post:

Quote   Quote: Originally Posted by gregrocker View Post
You want to operate as passworded Administrator, then create standard User account for others to use.

Test this standard account on the operations you want to restrict first and make a list of the ones which aren't restrictive enough, then post back or Google how to restrict each.

Title your post the exact function you want to restrict to get catch the attention of someone who knows the specific answer. Google probably already knows if you ask succinctly enough.
So I guess my entire post wasn't "VERY bad advice"?

Quote   Quote: Originally Posted by nicholas8814 View Post
I think i understand that process, however I am unable to set myself as owner privileged. I am signed in on admin account, but it will not allow me to take ownership over the local disk, even though there is no account set as the owner.
Try this:
Take Ownership Shortcut
My System SpecsSystem Spec
05 Jul 2010   #8
chev65

Windows 7 Ult, Windows 8.1 Pro,
 
 

I'm still wondering what the OP meant about "standard" User accounts. Are these Users on different machines? Or are these User accounts on the same machine?

If the User accounts are on seperate machines then using the Group Policy Editor is the way to go for this assuming that the Op has Windows 7 pro or above.
http://blogs.techrepublic.com.com/10things/?p=1014

If the User account is on the same machine then there are more options for restricting access. Big difference between the two as far as restricting things go.

The OP needs to be more precise when asking these sorts of questions or it can get very confusing for everyone.

And no Greg, I don't think your answer was very bad advice at all, considering that you linked to a post from the "How to Guy" that pretty much said that same thing. I believe that Jon could have easily reworded his advice to be more polite. But lets not waste more time arguing this point...

If they are on the same machine then using the Guest mode will put the account back to square one everytime they sign out. You can read about using Guest mode in the link below. It seems to be what the Op was asking about.
http://www.winsupersite.com/win7/ff_pcsafeguard.asp
My System SpecsSystem Spec
05 Jul 2010   #9
solarmystic

Windows 7 x64 Professional SP1
 
 

@chev65 It seems like Guest Mode has been removed from Windows 7 RTM 7600 after MS deemed it caused many bugs in its implementation.. The option does not appear in the Manage another account box... Here's to hoping it comes back in a Service Pack.
My System SpecsSystem Spec
06 Jul 2010   #10
JonM33

Windows 7 Home Premium x64
 
 

Quote   Quote: Originally Posted by gregrocker View Post
So I guess my entire post wasn't "VERY bad advice"?
Well, I said it was very bad advice even for HTG. That was indicative of the link regarding using "Deny" NTFS permissions.

I apologize if you felt it was referencing your entire post.

Bottom line with NTFS, never use "Deny". Best practice is to create a local security group, add whatever users to that group that you want to have access, add that group to the folder's NTFS permissions with read only or write permission and then remove the remaining groups (such as Everyone) from that folder. Administrators will have "Full Control" by default.
My System SpecsSystem Spec
Reply

 How to place restrictions on standard user accounts beyond parentals




Thread Tools





Similar help and support threads
Thread Forum
Running admin created tasks in standard user accounts
My company has recently purchased internet filtering and monitoring software which requires admin access to run. I am trying to create a scheduled task from the task scheduler which runs the software as an admin any time any non-admin user logs on. However, no matter how I configure the task, it...
General Discussion
Cant Access Administrative Rights in Standard User Accounts
Hello, i m using Win7 Home Premium 64b, and till a few days back, i was enjoying a trouble free OS with a Standard User , along with an Admin one, where i always use the standard user account. When installing and uninstalling softwares(in the standard user account), it will ask for Administrative...
General Discussion
Standard User Account Restrictions
I want to stop my son from accessing 'my docs'. He has a basic account and I am administrator. How do I do this? Thanks.
General Discussion
Standard User Restrictions
I want to setup some type of parental control that when a user wants to install software they need to type in a password. How do i set this up? thanks in advance Maciek
General Discussion
How to remove programs in standard user accounts?
Please help!! I installed Win 7 64 and loaded all programs. Everytime I create a standard user account all programs that are installed on my administrator account transfers to my 2 standard user accounts and the guest account also. Even when I try to delete a program in my guest account or...
General Discussion
Standard User accounts issue
A few days ago, I heard about the .LNK file icon vulnerability, got a little concerned since there was no easy fix, and looked for ways to limit my exposure. After flailing about a bit, I decided it was time to look at the "Standard User" accounts in W7. I set up a new user, made it Standard,...
System Security

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 05:23.

Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App