How to deny access to Device manager in standard user account?

Hi all!

I'm running Windows 7 Ultimate x64 and I want to completely deny access to Device manager in standard (default) user account.
As I understand, Standard user has basically all administrator rights, especially with an administrator password.
I already made a full administrator account. Can this be done?

Thank you in advance.

You can do that via group policy as admin.

MataC said:

As I understand, Standard user has basically all administrator rights, especially with an administrator password.

No! Quite the opposite, the standard user exists to NOT to have any administrator right, that's the exact reason for them to exist in the first place. Normal users cannot do anything beyond their own profile folder, nothing system-wide can be affected by them (and attempts to do so will be greeted with an UAC prompt asking for a password or a plain access denied).

As for the "with an administrator password" part, as soon as you give an admin password to a person, he owns the machine. He can impersonate that admin account and use it to do whatever they want, no longer limited by their normal account. Of course if you want to restrict them to a standard user, you should never give them an admin password. Without that password, they're limited to their own account rights.

As for the question itself, standard users have read-only access to the device manager, they can view all the hardware, but cannot change anything. They'll be asked for administrator rights to do any modification. There is no need to do any change at all to the default system configuration to achieve that.

Thank you all for your responses.

I'm talking about the default user account when you install Windows 7 which, as I understand, is called Standard user account (not Limited user) and it's not an administrator account either.
In my experience, under that account, I can change everything, including the Device manager, I just get a popup sometimes asking me if I want to make that certain change (I've turned that off).

What I want to do is just deny access to Device manager in that default account, nothing else, I could still change everything else; installations, files, folders etc.

Forgive my slight lack of understanding since Windows 7 has a bit tricky user account system... :)

If the account isn't admin then you wouldn't be able to do anything like installation change settings

The account used by most home users is an admin account with the limitations imposed by UAC. By default this account has standard user rights with full admin rights available on request. You can't really restrict such an account. By design they have the exact same rights you do. Anyone with the knowledge readily available on the Internet can evade any restrictions you might put in place.

If you wish to restrict a user you must give them a standard user account with it's associated password and no others. They will be unable to make changes in Device manager, install or uninstall programs, or make any changes that effect other users. There is nothing a user with such an account can do to obtain admin rights. That is what a standard user account was created for and is being used for that purpose by many large corporations around the world. No system configuration changes are needed to accomplish this.

Of course if a user has access to the password of an admin level account they will have full access. It is up to you to ensure that doesn't happen.

Edit: for good security you should give the built in administrator account a good password and then disable it.

In summary.

For 1st user, after installation completed, this user do have admin rights.
By that meaning, it has the admin rights, but 1 level down from full Administrator access.

For how to bring this Administrator account

Built-in Administrator Account - Enable or Disable


The following is in my own opinion.

This Administrator access is hidden, by default.
You, as admin, can access to this full Administrator and with that power 100% it can do anything on your computer.
As for why it is not listed upon installation, it prevent malware and other virus to gain that level.
Once the malware gain that level, the malware can control you, your rights.

Aha, so it's basically impossible to put any kind of restriction on the default Windows 7 account because its a 1 level down administrator account.

Is it possible then to allow limited/standard users to uninstall and install programs and change folders?