Who runs Windows with administrative rights?

[BehindEnemyLines]

I'm currently running with my own account with full administrative rights (but not as an Administrator). But I will create a Limited account (or some kind of user account) when I do reinstall Windows. I did a testing using MS Virtual PC 2004, and running in a Limited account does prevent "major" damages to Windows by trojans and viruses.

SIDE NOTE:
When I try to change my current account to 'limited', Windows XP Pro wouldn't allow me. It says that there must be an administrative account. But I thought there's already one by the name 'Administrator' (which requires a password).

 

[ojai00]

I guess it's thinking that you're using the Administrator account as your account and it's trying to tell you that it's not safe...haha. I use my account with administrative rights on my XP box. You'll probably have to keep your account with administrative rights and add a new user to the computer with limited rights. Hope this helps.

 

[Nothinman]

Just about everyone uses Windows as an admin because it's such a PITA to run management tools as a limited user, runas isn't nearly as convenient as su or sudo on unix.

 

[Sunner]

I do, for reasons Nothinman mentioned.

Running Windows without admin privs is a major PITA unless you just run basic office apps and such.
I have my parents running a regular account unless they need to install something though, they just use Mozilla and OpenOffice anyway, so it's not a problem there.

 

[jhu]

i do for the same reasons mentioned above (or below). but the, i don't use windows that often.

 

[BehindEnemyLines]

Actually, I tried to change my own account with administrative rights using the 'Administrator' account. It still wouldn't allow me. The major annoyance for me is installing programs. They sometimes don't install to 'All Users'.

 

[spyordie007]

unfortunetly the runas options native to windows are still pretty poorly implimented; fortunetly there are a number of 3rd party applications that extend the GUI to make better use of it.

*I hear* that in future versions of Windows Microsoft wants to improve the runas capabilities; but of course only time will tell on that

-Erik

 

[Psych]

Concerning the new limited account...
The built-in administrator account is supposed to be the fail-safe account that is used when you go into safe mode or something similar. Microsoft doesn't want you running that as your main account, or even as your main administrative account, so most of the time the OS doesn't even acknowledge its existence. You have to mkae another account with administrative privileges before making a limited one.

But I run with the Administrator account anyway. Too much hassle with the user log on, and I'm the only one who ever uses the computer. Plus, I have Norton AV.

 

[13black]

Originally posted by: Psych
Concerning the new limited account...
The built-in administrator account is supposed to be the fail-safe account that is used when you go into safe mode or something similar. Microsoft doesn't want you running that as your main account, or even as your main administrative account, so most of the time the OS doesn't even acknowledge its existence. You have to mkae another account with administrative privileges before making a limited one.

But I run with the Administrator account anyway. Too much hassle with the user log on, and I'm the only one who ever uses the computer. Plus, I have Norton AV.

What would be the purpose of having an administrator account if Windows ignored it? True it isn't a good idea to use the admin account as your daily user. If that's the only account you have and it gets corrupted you are hosed. I have never had any problems creating another admin account for myself and a restricted user account for my step daughter from the default admin account. If your admin account is being ignored by windows you have a big problem with your windows install. I use an admin account for the same reasons already mentioned, power user just doesn't cut it for me.

 

[Sunner]

Originally posted by: Psych
Concerning the new limited account...
The built-in administrator account is supposed to be the fail-safe account that is used when you go into safe mode or something similar. Microsoft doesn't want you running that as your main account, or even as your main administrative account, so most of the time the OS doesn't even acknowledge its existence. You have to mkae another account with administrative privileges before making a limited one.

But I run with the Administrator account anyway. Too much hassle with the user log on, and I'm the only one who ever uses the computer. Plus, I have Norton AV.

When you setup WinXP, the accounts you create during the setup will all have admin privileges.
Makes the Administrator account a pretty moot point.

 

[drag]

I thought that windows had something like "sudo" for doing stuff that requires administrator rights from a limited account. I swear I heard that you could do something like that, maybe just for win2003, though...

Is it possible to do something like "set suid" for stuff like Norton antivirus, or give people semi-administrator rights?

 

[Sunner]

Originally posted by: drag
I thought that windows had something like "sudo" for doing stuff that requires administrator rights from a limited account. I swear I heard that you could do something like that, maybe just for win2003, though...

Is it possible to do something like "set suid" for stuff like Norton antivirus, or give people semi-administrator rights?

There's "Run as..." but it's not always terribly useful, and nowhere near the functionality of su(do).

 

[n0cmonkey]

I don't have admin rights at work, and I didn't/wouldn't use them at home.

 

[CTho9305]

Originally posted by: Sunner

Originally posted by: drag
I thought that windows had something like "sudo" for doing stuff that requires administrator rights from a limited account. I swear I heard that you could do something like that, maybe just for win2003, though...

Is it possible to do something like "set suid" for stuff like Norton antivirus, or give people semi-administrator rights?

There's "Run as..." but it's not always terribly useful, and nowhere near the functionality of su(do).

the actual command is "runas".

I run with admin privileges, because I'm stupid. Or maybe the reasons mentioned above.

For "semi-administrator", look at the "power user" group. You can also customize privileges if you really want to use fine-grained control.

 

[n0cmonkey]

Originally posted by: CTho9305

Originally posted by: Sunner

Originally posted by: drag
I thought that windows had something like "sudo" for doing stuff that requires administrator rights from a limited account. I swear I heard that you could do something like that, maybe just for win2003, though...

Is it possible to do something like "set suid" for stuff like Norton antivirus, or give people semi-administrator rights?

There's "Run as..." but it's not always terribly useful, and nowhere near the functionality of su(do).

the actual command is "runas".

I run with admin privileges, because I'm stupid. Or maybe the reasons mentioned above.

For "semi-administrator", look at the "power user" group. You can also customize privileges if you really want to use fine-grained control.

Some people are smart enough to be able to get by as administrator, I know I'm not

 

[Sunner]

Originally posted by: CTho9305

Originally posted by: Sunner

Originally posted by: drag
I thought that windows had something like "sudo" for doing stuff that requires administrator rights from a limited account. I swear I heard that you could do something like that, maybe just for win2003, though...

Is it possible to do something like "set suid" for stuff like Norton antivirus, or give people semi-administrator rights?

There's "Run as..." but it's not always terribly useful, and nowhere near the functionality of su(do).

the actual command is "runas".

I run with admin privileges, because I'm stupid. Or maybe the reasons mentioned above.

For "semi-administrator", look at the "power user" group. You can also customize privileges if you really want to use fine-grained control.

Yeah the CLI command, I was referring to the GUI version, but whatever

 

[mikecel79]

At work I have admin rights on my machine and in the domain. However starting next week we are removing domain admin rights from our 2 LAN admins (Myself and one other guy). We've delegated most if not all authority we need to manage the domain using groups and ACLS in AD. We'll still have admin rights on the servers and workstations.

It takes a lot of work to get a non-admin account to run management tools. Runas was a start but it needs to come a long way.

 

[crimson117]

Originally posted by: BehindEnemyLines
I'm currently running with my own account with full administrative rights (but not as an Administrator). But I will create a Limited account (or some kind of user account) when I do reinstall Windows. I did a testing using MS Virtual PC 2004, and running in a Limited account does prevent "major" damages to Windows by trojans and viruses.

SIDE NOTE:
When I try to change my current account to 'limited', Windows XP Pro wouldn't allow me. It says that there must be an administrative account. But I thought there's already one by the name 'Administrator' (which requires a password).

although it's probably good practice to use a normal user acount for your everyday activities, I prefer using my admin account for its convenience, and a good firewall/antivirus for safety.

 

[Nothinman]

I prefer using my admin account for its convenience, and a good firewall/antivirus for safety.

Running as non-admin isn't supposed to protect you from viruses and the like, it's more to protect you from yourself. It's a lot harder to accidentally break something if you don't have rights to and if you have to authenticate before you do something chances are better that you realize what you're doing.

 

[Guga]

You can remove yourself of the administrators groups doing manually.
Boot in safe mode and log with administrator account. Go to My Computer - Manage.
In Computer manager on Local Users and Groups expand Groups, double click administrators and remove your user account from the members of.

This will solve your question, now I think it's not the best approach...

Running your desktop without administratives previleges is a PITA, unless of course you are managing a real network with servers running services that must be protected..

You can try run a few days (hours?) your account without administratives previleges and see if you can go on with that..