Changing User Permissions

[Tomha]

(Sorry if this is in the wrong area I cant find any area of this forums relating to user accounts).

So I changed my user account to the Windows 7 Super Admin account because I am easily annoyed when a computer tries to lock me out of areas I am completely okay with this and have no issues. However, many people keep telling me all about how this is a very bad thing to do, e.g. if I get a virus the virus has full control of my system. I dont disagree with this and I can understand it, I just find the benefits of super admin outweigh the risk considering I generally know what I am doing, how to avoid viruses, etc.

I have considered though swapping back to a regular admin account and enabling UAC, however there is so much data, programs installed, program preferences, etc stored on my user, last time I changed it was about a month before things were back to normal. Does anyone know how I could just change the permissions of my current account (the super admin account)?

I somehow doubt it is possible, considering this is the super admin account, if anyone instead knows of a good user migration tool that can transfer data from user to user that would also be great.

Thanks

 

[ozzy441]

If you were to change the permissions which applied to your current account, you would effectively be changing the permissions for the system admin account. Anything executed or done as system admin would be within the confines of the set parameters, which may have an effect on certain applications, depending on how they are coded.

To draw comparison, its like having superuser and user in linux, and allowing su only to do what user can do, thus eliminating any possibility of using elevated permissions through su (su or sudo would still happen, superuser still exists, but permissions would be rejected)

It is slightly different with Windows 7, and it wouldn't be that drastic, but there are some processes I believe which rely on the system administrator account.

That being said, I'm not sure how you would go about stripping the Sytem Admin account of its power in the first place, or even if its possible.

I sounded much more helpful in my head than I actually was. Ah well :/

 

[bbearren]

What do you mean by "super admin account"?

 

[Tomha]

Sorry, its a term I picked up in a how-to a while back Its the hidden windows 7 administrator account, i.e. the account with control over everything without any need for verification. This can be a risk because if a virus runs while this account is logged in, the virus also has permission/control over everything.

And thanks for the help ozzy, I was hoping to do something like that but like you im a little stumped as to how to go about it . I shall have a bit more of a look around.

 

[bbearren]

I don't think there's a lot that can be done to the default Windows Administrator account other than enable it or disable it. I don't think you can change the privilige level on that account.

 

[Brds7t7]

I thought that too. It was my understanding that privilege levels in the Admin account were not changeable and you had to set up a new account as admin to change privileges.

 

[ozzy441]

It would make logical sense, as an account lower in the 'hierarchy' i.e. less privileges cutting privileges for a higher privileges account would seem odd.

If you want to avoid having to set-up a new account, you could always migrate settings to a new Admin with UAC disabled. (Sorry, I forget how - there should be a tutorial around somewhere)

 

[logicearth]

Let me clear up a few things. There is no Super Admin account. The Administrator account that is disabled by default is not more powerful. The only thing about it is that it runs elevated all the time. While those part of the Administrators group run with a dual token and require elevation to a high level at request.

However, you can change it...from Local Security Policy.

User Account Control: Use Admin Approval Mode for the built-in Administrator account

This policy setting controls the behavior of Admin Approval Mode for the built-in Administrator account.

The options are:

• Enabled: The built-in Administrator account uses Admin Approval Mode. By default, any operation that requires elevation of privilege will prompt the user to approve the operation.

• Disabled: (Default) The built-in Administrator account runs all applications with full administrative privilege.

 

[bbearren]

Let me clear up a few things. There is no Super Admin account. The Administrator account that is disabled by default is not more powerful.

I have found that there are a few registry settings that will respond only to the default Windows Administrator account, and to no other account in the Adminstrators Group. That indicates to me that there are a couple or two privileges the default Windows Administrator account has that the Administrators Group does not have.

 

[Tomha]

Well I can understand what is being said of the default administrator account, but when I compare it with the admin account I had previously, it asked me about literally everything to do with system files, appdata, program files, anything in C:/WINDOWS, etc. I tried to get this to stop but didnt have much luck (Yes I was undoubtedly doing a lot wrong, I was new to windows 7 at the time). Now using the Windows 7 default admin account, no change of privileges I can do seems to change anything, I can still do what ever I want whenever. Like I say, this is exactly what I want, but its a security risk.

Logicearth could you tell me how I enable admin mode approval? And are you able to tell me if this will potentially block a virus should it have control within the account and attempt to make registry changes and such?

Thanks for the help so far guys It might not seem much like it but I'm getting somewhere