Solved How to deny access to Device manager in standard user account?

[MataC]

Hi all!

I'm running Windows 7 Ultimate x64 and I want to completely deny access to Device manager in standard (default) user account.
As I understand, Standard user has basically all administrator rights, especially with an administrator password.
I already made a full administrator account. Can this be done?

Thank you in advance.

 

[cajuntiger]

You can do that via group policy as admin.

 

[Brink]

Hello MataC, and welcome to Seven Forums.

You could use OPTION TWO in the tutorial below to apply the group policy to the user or a group.

http://www.sevenforums.com/tutorials/120378-device-manager-mmc-snap-enable-disable.html

 

[Alejandro85]

As I understand, Standard user has basically all administrator rights, especially with an administrator password.

No! Quite the opposite, the standard user exists to NOT to have any administrator right, that's the exact reason for them to exist in the first place. Normal users cannot do anything beyond their own profile folder, nothing system-wide can be affected by them (and attempts to do so will be greeted with an UAC prompt asking for a password or a plain access denied).

As for the "with an administrator password" part, as soon as you give an admin password to a person, he owns the machine. He can impersonate that admin account and use it to do whatever they want, no longer limited by their normal account. Of course if you want to restrict them to a standard user, you should never give them an admin password. Without that password, they're limited to their own account rights.

As for the question itself, standard users have read-only access to the device manager, they can view all the hardware, but cannot change anything. They'll be asked for administrator rights to do any modification. There is no need to do any change at all to the default system configuration to achieve that.

 

[MataC]

Thank you all for your responses.

I'm talking about the default user account when you install Windows 7 which, as I understand, is called Standard user account (not Limited user) and it's not an administrator account either.
In my experience, under that account, I can change everything, including the Device manager, I just get a popup sometimes asking me if I want to make that certain change (I've turned that off).

What I want to do is just deny access to Device manager in that default account, nothing else, I could still change everything else; installations, files, folders etc.

Forgive my slight lack of understanding since Windows 7 has a bit tricky user account system...

 

[samuria]

If the account isn't admin then you wouldn't be able to do anything like installation change settings

 

[Brink]

Thank you all for your responses.

I'm talking about the default user account when you install Windows 7 which, as I understand, is called Standard user account (not Limited user) and it's not an administrator account either.
In my experience, under that account, I can change everything, including the Device manager, I just get a popup sometimes asking me if I want to make that certain change (I've turned that off).

What I want to do is just deny access to Device manager in that default account, nothing else, I could still change everything else; installations, files, folders etc.

Forgive my slight lack of understanding since Windows 7 has a bit tricky user account system...

The account that you setup during Windows installation would be an administrator type of account.

Administrator accounts are an unelevated account that has complete access to the computer and can make any desired changes. Based on your UAC notification settings, administrators may be prompted to provide their password or confirmation before being allowed to open or run anything that requires elevated rights to do so, and make changes that affect the system or other users.

 

[LMiller7]

The account used by most home users is an admin account with the limitations imposed by UAC. By default this account has standard user rights with full admin rights available on request. You can't really restrict such an account. By design they have the exact same rights you do. Anyone with the knowledge readily available on the Internet can evade any restrictions you might put in place.

If you wish to restrict a user you must give them a standard user account with it's associated password and no others. They will be unable to make changes in Device manager, install or uninstall programs, or make any changes that effect other users. There is nothing a user with such an account can do to obtain admin rights. That is what a standard user account was created for and is being used for that purpose by many large corporations around the world. No system configuration changes are needed to accomplish this.

Of course if a user has access to the password of an admin level account they will have full access. It is up to you to ensure that doesn't happen.

Edit: for good security you should give the built in administrator account a good password and then disable it.

 

[Eric3742]

In summary.

For 1st user, after installation completed, this user do have admin rights.
By that meaning, it has the admin rights, but 1 level down from full Administrator access.

For how to bring this Administrator account

http://www.sevenforums.com/tutorials/507-built-administrator-account-enable-disable.html


The following is in my own opinion.

This Administrator access is hidden, by default.
You, as admin, can access to this full Administrator and with that power 100% it can do anything on your computer.
As for why it is not listed upon installation, it prevent malware and other virus to gain that level.
Once the malware gain that level, the malware can control you, your rights.

 

[MataC]

Aha, so it's basically impossible to put any kind of restriction on the default Windows 7 account because its a 1 level down administrator account.

Is it possible then to allow limited/standard users to uninstall and install programs and change folders?

 

[LMiller7]

Aha, so it's basically impossible to put any kind of restriction on the default Windows 7 account because its a 1 level down administrator account.

Is it possible then to allow limited/standard users to uninstall and install programs and change folders?

This may be possible in theory but it wouldn't be useful. Installing applications requires a lot of high level permissions and any account that has that would for most practical purposes be an admin account in all but name. Such an account could do a lot of damage to the system, whether by accident or intent. Any account that can install applications can uninstall them as well. Any attempt to restrict an admin level account is an exercise in futility. Any restriction you might put in place can be removed by any other admin. This an inherent characteristic of an admin account and cannot be removed.

By design an admin level account is the highest user account in the system and has complete control over the computer. It was intended that there would be one or a small number of trusted individuals with such an account. Trust is essential. If someone cannot be trusted with an admin account they shouldn't be given one. It is as simple as that.

 

[MataC]

Aha, so it's basically impossible to put any kind of restriction on the default Windows 7 account because its a 1 level down administrator account.

Is it possible then to allow limited/standard users to uninstall and install programs and change folders?

This may be possible in theory but it wouldn't be useful. Installing applications requires a lot of high level permissions and any account that has that would for most practical purposes be an admin account in all but name. Such an account could do a lot of damage to the system, whether by accident or intent. Any account that can install applications can uninstall them as well. Any attempt to restrict an admin level account is an exercise in futility. Any restriction you might put in place can be removed by any other admin. This an inherent characteristic of an admin account and cannot be removed.

By design an admin level account is the highest user account in the system and has complete control over the computer. It was intended that there would be one or a small number of trusted individuals with such an account. Trust is essential. If someone cannot be trusted with an admin account they shouldn't be given one. It is as simple as that.

Ok, I understand all that, but I'm still interested how can this be done. Via group policy maybe?

 

[Brink]

MetaC,

If you like, you could use OPTION ONE below to prevent "standard users" from running Device Manager by using the "specific users or group" link in step 1.

http://www.sevenforums.com/tutorials/80605-applications-prevent-running-specified-programs.html