How to prevent administrator to change super admin's password?

[jakematteau]

Hi! I have 2 users for now on my pc: Super admin and admin. For some personnal reasons, i want the user admin to have the rights to install software...have more rights..

But I don want admin to be able to change the super administrator's password: is there a way, strategy or something i can do to prevent this?

Thank you!

 

[Alejandro85]

There is no thing as a "super admin" in Windows, all administrators are exactly the same and have the same privileges. They have the right to install programs, and they need to be admins to do such things, but that also grants them the rights to do any system-wide change, like managing users and their passwords, at the same time.

What is your idea behind having two "levels" of admins? What do you plan to accomplish with that?

 

[LMiller7]

How to prevent administrator to change super admin's password?

You can't.

By "super admin" I assume you mean the built in Administrator account. It was never intended that it be used for general use. Unlike other admin accounts it is not effected by UAC but aside from that all admin accounts are equal. ALL admin accounts have the ability to change ANY password, including that of the Administrator account. This is by design and cannot be restricted.

Bottom line: ALL admin accounts are essentially equal.

There is no technical solution for your issue. All you can do is establish policies known to all admins. If they do not conform you must take the appropriate action, such as removal of admin rights.

 

[Brink]

The built-in "Administrator" is an elevated account by default.

By default, a normal administrator account is not elevated and requires UAC (Yes/No) approval first for elevated actions.

http://www.sevenforums.com/tutorials/507-built-administrator-account-enable-disable.html


As Alejandro posted above, it's not possible to prevent administrator accounts from doing anything since they all have the rights to do what they please to the system.

If you don't trust them, then you could make them a standard user that would not be able to have any elevated rights.

Hope this helps some,
Shawn

 

[jakematteau]

Thank you for your answers: it all does make sense! What i'm trying to do was just have a admin who still can block some access to some folder etc. but I did'nt want to block the other user from intalling programs, doing updates. I guess i will go with a standard user, maybe learn to give it more rights.

I will have to learn more about policies...but that will be another thread!

Thanks again!

 

[Alejandro85]

It's a difficult thing to achieve, administrators by design can do everything on the system, that's the purpose of the account. It includes setting permissions, installing programs and all system-wide changes. All limitations on those accounts can be lifted by themselves, so it's pointless.

I doubt about "giving more rights" to standard users for installations. Properly made installers should display an UAC prompt to begin the process, and that can only be allowed by an administrator user/password, which standard user cannot bypass. Your best bet is probably sticking to the so called "portable" software, which is simply packaged in a zip file that you run directly.