Is there anyway that I can stop my administrator account in Windows 7 Ultimate from having its status, permissions and password changed by other administrators? My brother (who is younger than me) keeps putting my account down to standard, and once changed my password. Unfortunately he is an administrator as well. Is there any way I can prevent him doing this without removing his administrator status?
Sorry, but no. If it is your machine (and he has been doing this on a regular basis), then downgrade his account to a standard one. Change the password on your account to one that he doesn't know so that he can't elevate. Even better, create a new administrator account for use when you need administrative privileges, set a password which only you know (don't disclose this to your brother) and then make your own account standard as well. If you need administrative privileges, you can always elevate yourself. In addition, see Secure Logon - Press CTRL + ALT + DELETE to log on
As I know that, If you don't have Administrative permission, you can not prevent him changing your pwd.
Administrator can change User's password without having old password.
One thing you could do that would form a compromise is to set your ID as admin or create a new admin level user and then create a power users level group which will have enough access to do all that the admin can except change/reset passwords.
Once created, by setting any user in this group they will be able to everything they need to do but not mess with admin passwords.
If you wish to be cruel you could of course set-up his account as a standard user set it so the password never expires and cannot be changed, of course you could then invoke the parental controls to severely limit his access times and areas. - but that would be cruel
How do I make the power users level group with enough admin rights except password and account type change? This seems to me the best option. Thanks to everybody for your help.One thing you could do that would form a compromise is to set your ID as admin or create a new admin level user and then create a power users level group which will have enough access to do all that the admin can except change/reset passwords.
Once created, by setting any user in this group they will be able to everything they need to do but not mess with admin passwords.
If you wish to be cruel you could of course set-up his account as a standard user set it so the password never expires and cannot be changed, of course you could then invoke the parental controls to severely limit his access times and areas. - but that would be cruel
Assuming you are using pro or ultimate a lot of the work has already been done for you :)
There is an existing group auto generated called "Power Users" - to access this you will need access to the advanced user account controls.
Shawn brink has a tutorial for allowing access to this ....
Control Panel - Add Advanced User Accounts
Once you have this working you should be able to remove the users account from the administrators group and add it to the power users group.
Once you have done this you can check that the requred security is in place
This should do what you want to do but if you need to tweak the actual group rights the individual rights assignment for each group is controlled using the group policy editor - local policies - user rights assignment.
Each right is listed with an explanation of what the right allows and any group can be added or removed as required
To be honest I would reduce his rights to a standard user and change your password, but I understand that family politics may prevent this option.
Also I must state that given physical access to the machine it is possible to, using freely available tools, override all Microsoft's login security.
Can you name any software to override the login?
Yes, but no. However, there are many posts around this forum that give that info.
I would do what others suggested.
I personally would use the Parental Controls also in this case.
See what they are doing when you are away.
The last surefire way of keeping them from using the system at all is to set a BIOS boot password.
"I hear the BIOS password can be reset or removed by simply taking the BIOS battery out of the motherboard for a period of time, usually around 5-10 minutes.
Also how can I see what they are doing while I'm away?
And why not name any override tools?
Thanks "
that will reset the motherboard clock and what not, but not the BIOS password. and it happen almost instantly. don't need to wait 5-10 minutes
Quote