Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: How to prevent Guest account from making modifications to the computer


04 Sep 2012   #1

Windows 7 X64 version 6.1.7601
 
 
How to prevent Guest account from making modifications to the computer

Hellllllo !

On my work laptop I have my Administrator account, which I use all the time, and a Guest account that people can use to go on the Internet etc.

What I have not found out how to do yet is to prevent the Guest account users from :

- Installing or removing software
- Changing any setting in control panel (or the shortcuts leading to it, such as "right-click on the Desktop > personalize"
- Changing internet connections (I've caught guests on the neighbor's open network often, even though my WPA2 wireless network is remembered)

What I have found how to do, using permissions:

- Open specific programs (I have gone and edited the permissions on all the .exes files for the programs I wanted to restrict, and it works fine)
- Access partitions or hard drives (Guests only see the path exists, they have no access and no info to the partitions/drives I restricted)

Now, about my problem, what I've tried so far:

- Same as I did to restrict access to partitions/hard drives, using permissions: I tried to modify the permissions of the Guest account to allow only reading and launching apps on C: as a whole. That didn't work though, Windows wouldn't let me change the permissions on the system disc, even as an administrator with UAC off. I tried many combinations of allow/deny and no change is permitted.

So, what can I do ? Right now, there are only a few shortcuts on the Guest account desktop, but I've tested it: using the Start menu or the command prompt a guest can access so many settings on the computer ! Modify Windows sounds, fonts and styles, uninstall or install programs, modify power plans or Windows update settings, etc etc... all Control Panel items it seems. In fact, I'm amazed at how the Guest account is NOT restricted! The only thing it can't do, without tweaking, is access other users' folders on C: I mean what the flip ?

What I have found so far to help me, and that doesn't solve my problem :

Programs and Features - Enable or Disable not good because it's for ALL users, including admins. I only want to restrict the Guest account.
How To Disable Control Panel in Windows 7 - How-To Geek same thing
Restrict Specific Users From Accessing Windows Control Panel would be good but applies to Vista and I have not found the equivalent for 7
Prevent users from accessing the Control Panel but allow Administrators would also be good but the software doesn't exit for 7.

Final note: It would be ideal if guests could update Java, Flash, Firefox etc. when they get prompted, but if the solution you give me prevents that, no problem. The most important is to prevent the Guest account any access to Control Panel items, especially Add or Remove Programs.

Thank you for your time !


My System SpecsSystem Spec
.

04 Sep 2012   #2

Microsoft Community Contributor Award Recipient

Microsoft Windows 7 Home Premium 64-bits 7601 Multiprocessor Free Service Pack 1
 
 

A guest account DOESN'T have admin rights, just as a standard user. He/she cannot modify registry keys in HKLM so cannot modify system wide settings!

He can change his own font and his own windows sounds. But not install programs.
My System SpecsSystem Spec
04 Sep 2012   #3

Windows 7 X64 version 6.1.7601
 
 
Partial oops

Hello Kaktussoft !

Sorry, I have checked and you're right, the control panel options that seem to be accessible to the Guest account are those regarding the accounts' preferences only (display, font, ease of access etc. etc.) and *not* Firewall, Backup & Restore, Administrative tools, etc. Maybe while testing I had inadvertently clicked "Run as Administrator" or something...

Still, the Power Plans, what the lid/power button does, when and if the computer sleeps, etc. are available for tinkering for instance. I'm wondering, what else? Wouldn't it be much simpler if Control Panel was simply denied to the Guest account ?

Also, when testing for the ability to install programs, I made the mistake of aborting during installation, because I had not realized that the inability to install programs manifested itself at the very end of the process. Download zipped installer, unzip, execute, installation begins, etc. but at the very end it says installation failed for lack of permission. Maybe it's because I tried with open-source programs (VLC and OpenOffice) which may be more aggressive in their installation process... I could try with something commercial. See the result here for OpenOffice

I was however able to uninstall programs, and that's a problem. See before and after but I haven't started uninstalling everything just to test things out. If you're curious I could try but I don't have much useless stuff installed... =)

But I'm willing to wait for someone to simply reveal the way to block access to any and all Control Panel items for a specific user, which would take care of everything. Including pranks: someone logged in the Guest account and changed the wallpaper to a very suggestive picture of Paul Walker, I don't know how long ago, and yesterday my mother wanted to use the computer... "son, what is this ?!?!" lol ! This is what prompted my investigation in fact.

Anyways, sorry about the mistakes and thanks a bunch Kaktussoft.
My System SpecsSystem Spec
.


04 Sep 2012   #4

Microsoft Community Contributor Award Recipient

Microsoft Windows 7 Home Premium 64-bits 7601 Multiprocessor Free Service Pack 1
 
 

A guest user cannot write to c:\program files and c:\windows and more folders. In registry he cannot write to HKEY_LOCAL_MACHINE and more registry keys.

Check it yourself!!

But all changes to "user stuff" like background image will retain.
My System SpecsSystem Spec
04 Sep 2012   #5

Windows 7 X64 version 6.1.7601
 
 
surprised

Quote   Quote: Originally Posted by Kaktussoft View Post
A guest user cannot write to c:\program files and c:\windows and more folders. In regsitry he cannot write to HKEY_LOCAL_MACHINE and more registry keys.
I know ! That's why I'm surprised I was able to uninstall Synergy (you've seen the image) and VLC Player, while logged is as Guest user... But as I said, it's the only two I have tried uninstalling, and I couldn't install them back or anything else in fact, "no permission"
My System SpecsSystem Spec
04 Sep 2012   #6

Microsoft Community Contributor Award Recipient

Microsoft Windows 7 Home Premium 64-bits 7601 Multiprocessor Free Service Pack 1
 
 

rename c:\users\guest\ntuser.dat to c:\users\guest\ntuser.man
Please test it. Then user settings are reverted to as it was.
My System SpecsSystem Spec
Reply

 How to prevent Guest account from making modifications to the computer




Thread Tools



Similar help and support threads for2: How to prevent Guest account from making modifications to the computer
Thread Forum
Is W7 Guest Account the Safest Account to Use On the Web? System Security
Set Guest Account Similar As Primary Account,(except on Several Files) General Discussion
Need To Disable Guest Account On Admin Account General Discussion
Any way to prevent notepad or Emacs from making file associations? General Discussion
My Administrator account turned to Guest account General Discussion
Can't log onto guest account General Discussion
Making User Account into Admin Account System Security

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 09:00 AM.
Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App
  

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33