Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: How to prevent Guest account from making modifications to the computer

04 Sep 2012   #1
XavierDery

Windows 7 X64 version 6.1.7601
 
 
How to prevent Guest account from making modifications to the computer

Hellllllo !

On my work laptop I have my Administrator account, which I use all the time, and a Guest account that people can use to go on the Internet etc.

What I have not found out how to do yet is to prevent the Guest account users from :

- Installing or removing software
- Changing any setting in control panel (or the shortcuts leading to it, such as "right-click on the Desktop > personalize"
- Changing internet connections (I've caught guests on the neighbor's open network often, even though my WPA2 wireless network is remembered)

What I have found how to do, using permissions:

- Open specific programs (I have gone and edited the permissions on all the .exes files for the programs I wanted to restrict, and it works fine)
- Access partitions or hard drives (Guests only see the path exists, they have no access and no info to the partitions/drives I restricted)

Now, about my problem, what I've tried so far:

- Same as I did to restrict access to partitions/hard drives, using permissions: I tried to modify the permissions of the Guest account to allow only reading and launching apps on C: as a whole. That didn't work though, Windows wouldn't let me change the permissions on the system disc, even as an administrator with UAC off. I tried many combinations of allow/deny and no change is permitted.

So, what can I do ? Right now, there are only a few shortcuts on the Guest account desktop, but I've tested it: using the Start menu or the command prompt a guest can access so many settings on the computer ! Modify Windows sounds, fonts and styles, uninstall or install programs, modify power plans or Windows update settings, etc etc... all Control Panel items it seems. In fact, I'm amazed at how the Guest account is NOT restricted! The only thing it can't do, without tweaking, is access other users' folders on C: I mean what the flip ?

What I have found so far to help me, and that doesn't solve my problem :

Programs and Features - Enable or Disable not good because it's for ALL users, including admins. I only want to restrict the Guest account.
How To Disable Control Panel in Windows 7 - How-To Geek same thing
Restrict Specific Users From Accessing Windows Control Panel would be good but applies to Vista and I have not found the equivalent for 7
Prevent users from accessing the Control Panel but allow Administrators would also be good but the software doesn't exit for 7.

Final note: It would be ideal if guests could update Java, Flash, Firefox etc. when they get prompted, but if the solution you give me prevents that, no problem. The most important is to prevent the Guest account any access to Control Panel items, especially Add or Remove Programs.

Thank you for your time !


My System SpecsSystem Spec
.
04 Sep 2012   #2
Kaktussoft

Microsoft Community Contributor Award Recipient

Microsoft Windows 7 Home Premium 64-bits 7601 Multiprocessor Free Service Pack 1
 
 

A guest account DOESN'T have admin rights, just as a standard user. He/she cannot modify registry keys in HKLM so cannot modify system wide settings!

He can change his own font and his own windows sounds. But not install programs.
My System SpecsSystem Spec
04 Sep 2012   #3
XavierDery

Windows 7 X64 version 6.1.7601
 
 
Partial oops

Hello Kaktussoft !

Sorry, I have checked and you're right, the control panel options that seem to be accessible to the Guest account are those regarding the accounts' preferences only (display, font, ease of access etc. etc.) and *not* Firewall, Backup & Restore, Administrative tools, etc. Maybe while testing I had inadvertently clicked "Run as Administrator" or something...

Still, the Power Plans, what the lid/power button does, when and if the computer sleeps, etc. are available for tinkering for instance. I'm wondering, what else? Wouldn't it be much simpler if Control Panel was simply denied to the Guest account ?

Also, when testing for the ability to install programs, I made the mistake of aborting during installation, because I had not realized that the inability to install programs manifested itself at the very end of the process. Download zipped installer, unzip, execute, installation begins, etc. but at the very end it says installation failed for lack of permission. Maybe it's because I tried with open-source programs (VLC and OpenOffice) which may be more aggressive in their installation process... I could try with something commercial. See the result here for OpenOffice

I was however able to uninstall programs, and that's a problem. See before and after but I haven't started uninstalling everything just to test things out. If you're curious I could try but I don't have much useless stuff installed... =)

But I'm willing to wait for someone to simply reveal the way to block access to any and all Control Panel items for a specific user, which would take care of everything. Including pranks: someone logged in the Guest account and changed the wallpaper to a very suggestive picture of Paul Walker, I don't know how long ago, and yesterday my mother wanted to use the computer... "son, what is this ?!?!" lol ! This is what prompted my investigation in fact.

Anyways, sorry about the mistakes and thanks a bunch Kaktussoft.
My System SpecsSystem Spec
.

04 Sep 2012   #4
Kaktussoft

Microsoft Community Contributor Award Recipient

Microsoft Windows 7 Home Premium 64-bits 7601 Multiprocessor Free Service Pack 1
 
 

A guest user cannot write to c:\program files and c:\windows and more folders. In registry he cannot write to HKEY_LOCAL_MACHINE and more registry keys.

Check it yourself!!

But all changes to "user stuff" like background image will retain.
My System SpecsSystem Spec
04 Sep 2012   #5
XavierDery

Windows 7 X64 version 6.1.7601
 
 
surprised

Quote   Quote: Originally Posted by Kaktussoft View Post
A guest user cannot write to c:\program files and c:\windows and more folders. In regsitry he cannot write to HKEY_LOCAL_MACHINE and more registry keys.
I know ! That's why I'm surprised I was able to uninstall Synergy (you've seen the image) and VLC Player, while logged is as Guest user... But as I said, it's the only two I have tried uninstalling, and I couldn't install them back or anything else in fact, "no permission"
My System SpecsSystem Spec
04 Sep 2012   #6
Kaktussoft

Microsoft Community Contributor Award Recipient

Microsoft Windows 7 Home Premium 64-bits 7601 Multiprocessor Free Service Pack 1
 
 

rename c:\users\guest\ntuser.dat to c:\users\guest\ntuser.man
Please test it. Then user settings are reverted to as it was.
My System SpecsSystem Spec
Reply

 How to prevent Guest account from making modifications to the computer




Thread Tools





Similar help and support threads
Thread Forum
User account changed into a guest account, how can I change it back
So this is probably the strangest problem I have ever encountered with Windows 7. About two or three months ago, I noticed that my user account had suddenly changed into a guest account. I get prompted for an administrator password when trying to do any tasks that require administrator privilege....
General Discussion
Is W7 Guest Account the Safest Account to Use On the Web?
I've been plagued Trojans and re-directs lately with a W7 Standard Account which I thought and taught was the right choice for safer web browsing. Not as many system ports open to attack. So, if MS recommends the Standard Account over Administrator for safety reasons, is using the Guest...
System Security
Set Guest Account Similar As Primary Account,(except on Several Files)
Hi all.. Just wondering.. is it possible for me to set my guest account similar as my primary account but with several file or folder or software in my primary account , cant be access in my guest account? means i still can instll the new software, or application, and still can save new document...
General Discussion
Need To Disable Guest Account On Admin Account
My friend and I share my laptop. Recently I found out that he was watching porn on my computer. So I promptly confronted him, and told him to stop. Weeks later, he did it again. So I downloaded Norton's Safety Minder to prevent it. So this sneaky prick goes around and enables the guest account, and...
General Discussion
My Administrator account turned to Guest account
Hey guys. Im having a problem with my computer!somehow my administrator account has turned to a guest account. Today I tried to unistall a program and it didnt let me saying i needed to be admin. :(:(. Also I tried turning it to admin by using cmd command but it says access not allowed.
General Discussion
Making User Account into Admin Account
I'm not sure if this is in the right forum, or even if this is possible, but... Is there any possible way to make it so that my normal account can be transformed into an administrator account? In order to make one of my games function properly, I need to enter the task manager and set the...
System Security

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 15:37.

Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App