Setting Up A Second User Account

[TheGardener]

I set up another user account on my laptop. This account has no admin privileges, and I am using it in hotspots. The intent is a layer of protection to limit malware crap from running. I'm pretty careful about where I go on the web, and this account uses firefox with ublock.

So the other day I am signed in on the new user account. I wanted to access a .doc file on the admin account. I figure that Windows 7 (sp1) will ask me to sign in as admin to open it. To my surprise I could see the files on this admin account. Worse I was able to access the .doc file without Windows requiring any password.

So did I do anything wrong, when setting up the new user account? Or were my expectations incorrect?

 

[Ketchup]

Did the other account have a password?

 

[TheGardener]

Did the other account have a password?

Yes. All accounts have passwords.

Is this the right/ best forum to ask this question?

 

[Ketchup]

OK, probably a dumb question, but I will ask anyway. What folder were the documents in?

 

[TheGardener]

The documents were in sub-folders under My Documents. I could see the entire directory of the account with Admin privilege using Windows Explorer.

 

[Ketchup]

OK. Well, one would think your assumption would be correct: that "standard" users wouldn't be able to view files in other users' profiles. But apparently, MS doesn't think like you and me. I believe this page will get you going:

http://superuser.com/questions/3852...s-from-accessing-files-in-other-user-accounts

Basically, you will want to deny read permissions for other users on that folder from your admin account.

 

[TheGardener]

Wow, that solution is really cryptic. No wonder I had so much trouble figuring this out. When setting up the account, I was asked to choose between a Standard User or an Administrator. I thought that selecting Standard User would limit the access of the new account. I shudder to think that setting up a guest account gives so much system access to the guest.

I tried fixing this from the Control Panel, but that didn't work. I could only delete the new account, not modify it, except for changing the password or parental controls.

So I've followed the instructions on the link. Now I need to test the new account. I'm sure that there will be multiple problems I'll be running into, since I chose "Deny" on all the attributes, as instructed.

Just for anyone interested. I did this from the Administrator account, and I ran into the Access Denied popup window. I kept clicking to override and it finally worked. I think.

Thanks for the pointer Ketchup. If things don't go well, I'll probably just delete the account

 

[TheGardener]

So the results were easy to see. After entering the password, I saw "Windows Preparing Desktop. So it was setting up, like the first time. There was a Windows notice in the taskbar which appeared, saying that any files saved would be deleted upon logout.

When I started up a few programs, it was like the first time. I'll look into this some more, but ultimately I may just delete the account, if I can't figure this out.