Win 7, possible to create Admin account only?

[Acleacius]

I've never tried this, nor can I find any info with googlefu, so not exactly sure how to ask it. Nor what kind of potential 'After/During Install' (if it works) I could/would run into. Hope this is at least clear enough to get the idea.

I'm working on trying to create a Windows 7 install with an Administrator activated account only, completely skipping User Creation.

My idea is to Reboot at the User Account Creation prompt. Once the machine reboots it creates a temp Admin account. Is it possible at this point to Unlock the Administrator account, then reboot getting the LogIn Prompt with only the Administrator as a choice?


Thanks for any help or tips.

 

[rasczak]

why would you want to do this?

The only thing I can think of would be to go through the setup process, then delete any accounts you created aside from the administrator account. Kinda defeats the purpose of UAC and security controls altogether, but to each their own.

 

[Acleacius]

Thanks for the tip rasczak.

Part of it's based in that I'm a gamer, new user to Win7 and many games now basically ask you to disable UAC. A recent example would be The Witcher 2 and the most common next word in a Google Search for, 'Windows 7 disable' is UAC. It also could be the search for the clean, lean efficacy of XP while retaining many of the upgrades of Win7.

I don't really want to bore you with the long list of bad design (not over all) decisions for semi experienced to experienced users, not being able to access their files, yet some are:
1. I'm the only one using the machine behind a firewall with reasonable protection, though nothing is full proof.
2. The number of redundant Inaccessible Directories filling up Explorer with Denied Access is not only annoying but frustrating and very inefficient.
3. Not to mention the constant need to either log in as Admin or Blanket grant access to individual files or whole folders just so I can get into my System Files to check drivers or edit ini files.
4. Probably goes without saying I have Show Hidden Files, File Extensions and System Files.

I'm just not really sure it will let me delete all the User Accounts even logged in as Administrator. There seems to be a even higher level than Administrator. Since had problems accessing some System Files/Directories requiring me to set some Global Permissions to my Administrator. Is there a pretty good chance this will work, I'll defiantly try it?


Thanks again for your help and tip.


There were several bits of info about Off Partitioning the Program Files, Users, ProgramData and Program Files (x86) to the D drive. So I was lucky in that regard and it's gone well in helping to prevent excessive Fragmentation of my OS. As an example of just the one game I mentioned above, it probably wouldn't be unusual to have 1.5 gig of save game files, just from the Autosave system built into the game.

 

[Nothinman]

Part of it's based in that I'm a gamer, new user to Win7 and many games now basically ask you to disable UAC. A recent example would be The Witcher 2 and the most common next word in a Google Search for, 'Windows 7 disable' is UAC. It also could be the search for the clean, lean efficacy of XP while retaining many of the upgrades of Win7.

Those games should be fixed and most likely means the developers don't know what they're doing, disabling UAC doesn't make the system any more clean or lean, all it does is remove one level of security. If a game really needs admin rights you can set it's shortcut to run as admin all the time.

1. I'm the only one using the machine behind a firewall with reasonable protection, though nothing is full proof.

Irrelevant, UAC protects you from stuff running on your PC that you may not know is doing something insidious or might end up running automatically via some exploit in IE, FF, etc not incoming traffic.

2. The number of redundant Inaccessible Directories filling up Explorer with Denied Access is not only annoying but frustrating and very inefficient.

Stop that. If you're getting that frequently then you're doing it wrong. I've been using Win7 at work since it came out and I can easily count the number of times I've seen that from file operations on 1 hand.

3. Not to mention the constant need to either log in as Admin or Blanket grant access to individual files or whole folders just so I can get into my System Files to check drivers or edit ini files.

Even with UAC you're logged in as admin, you just don't have an elevated token until you click Yes on the UAC prompt. But again, if you're getting that while editing ini files then you've either got the security set on them wrong or you're doing something you shouldn't normally be doing.

4. Probably goes without saying I have Show Hidden Files, File Extensions and System Files.

Same here, but I still don't see UAC prompts with any amount of frequency.

 

[imagoon]

Those games should be fixed and most likely means the developers don't know what they're doing, disabling UAC doesn't make the system any more clean or lean, all it does is remove one level of security. If a game really needs admin rights you can set it's shortcut to run as admin all the time.



Irrelevant, UAC protects you from stuff running on your PC that you may not know is doing something insidious or might end up running automatically via some exploit in IE, FF, etc not incoming traffic.



Stop that. If you're getting that frequently then you're doing it wrong. I've been using Win7 at work since it came out and I can easily count the number of times I've seen that from file operations on 1 hand.



Even with UAC you're logged in as admin, you just don't have an elevated token until you click Yes on the UAC prompt. But again, if you're getting that while editing ini files then you've either got the security set on them wrong or you're doing something you shouldn't normally be doing.



Same here, but I still don't see UAC prompts with any amount of frequency.

Basically the same here. I don't even run using a Domain admin account at work. My normal user is a typical low access level user account. It isn't hard. I consider people that do this lazy. Windows basically hands you the equivalent of "su" from linux yet people still want to run around as root.

-edit-

UAC is enabled and working on my gaming rig also.

 

[Acleacius]

No offense, appreciate you trying to help and I do get the impression your trying to help, thank you.
The problem is I know what I want, why, it's good enough for me and it's even reasonable.

I only listed some of the reasons becasue rasczak asked, I'm not trying to start a debate, just achieve what I'm trying to accomplish. None the less I will try to respond, in case it offers you some clarification. Nor at any point have I tried to convince anyone they must think like this or do this, just saying it's what is most effective for me.

Those games should be fixed and most likely means the developers don't know what they're doing, disabling UAC doesn't make the system any more clean or lean, all it does is remove one level of security. If a game really needs admin rights you can set it's shortcut to run as admin all the time.

The mere fact that it reduces the number of accounts and login possibilities is proof of it being leaner and cleaner. Each account duplicates many/most/all System Folders/Files. E.g. Waste and Redundancy at the very least. You can add as many layers as you want and call them more security, it doesn't necessarily make it good or beneficial, many times it can be bad or worst than having less layers To Protect. Also if your settings are anywhere near mine then you are seeing at least Redundant/Double of most Folders. E.g. In Users/Your account/ Click on App Data, then click Application Data. It's really not necessary to list all the examples of this since you sound experienced enough to see them yourself.

Irrelevant, UAC protects you from stuff running on your PC that you may not know is doing something insidious or might end up running automatically via some exploit in IE, FF, etc not incoming traffic.

Then lets call it opinion based and we each have our own. Reason being the mere fact that have to constantly get permission for what are fairly common edits, is by it's very nature redundancy without reason. If I ran XP for 10 years in my Own Way/Pathology (whatever you want to call it) and never had a problem, why do I all of sudden have to take twice along with Win7 to accomplish the same thing? That's not efficacy or more effective it's less.

Stop that. If you're getting that frequently then you're doing it wrong. I've been using Win7 at work since it came out and I can easily count the number of times I've seen that from file operations on 1 hand.

Thanks for your advice, once again, remember I'm just replying to you, not trying to make you use my method or judge your computer activities. No offense but you couldn't possibility know this.

Why would you think I'm doing something wrong, just becasue you don't experience the same thing. You can't possibly believe we have identical lifestyles on the computer. No offense, I haven't even provided you any information to make that call, since I was never even on the subject of asking if I should or shouldn't. Once again, remember I'm just replying to you, not trying to make you use my method or judge your computer activities.

Even with UAC you're logged in as admin, you just don't have an elevated token until you click Yes on the UAC prompt. But again, if you're getting that while editing ini files then you've either got the security set on them wrong or you're doing something you shouldn't normally be doing.

Then, this by it's very nature proves we have different settings or lifestyles on our PCs. As I mentioned, even being logged in with Admin rights doesn't not give you full Admin Rights. You either have to log Out, then in as Full Admin or spend time giving blanket Admin rights to many System ini files and/or folders. Hell, even if you Log In as Full Admin there is STILL at least one more level/layer higher, requiring you to give Global Permissions to your Full Admin rights for certain System files/folders.


imagoon. thanks for your information.


The only thing I can think of is somehow my confusion on HOW to achieve this was transmitted into confusion of whether/if/should I do this. It must have been the two hours of sleep I got last night, my apologizes.


I'll try again, could someone please help me create a Full Admin only Win 7 Install?


Thanks for any help or tips. :cheers:


Edit. I'm at least glad there was lots of info in Goolefu about Off Partitioning Program Files, Users, ProgramData and Program Files (x86) to the D partition, made it pretty easy to resolve and accomplish.

 

[Nothinman]

No offense, appreciate you trying to help and I do get the impression your trying to help, thank you.
The problem is I know what I want, why, it's good enough for me and it's even reasonable.

I only listed some of the reasons becasue rasczak asked, I'm not trying to start a debate, just achieve what I'm trying to accomplish. None the less I will try to respond, in case it offers you some clarification. Nor at any point have I tried to convince anyone they must think like this or do this, just saying it's what is most effective for me.

Except that it's not. Turning off UAC and deleting accounts has no affect on performance and only lessens the security of your system.

The mere fact that it reduces the number of accounts and login possibilities is proof of it being leaner and cleaner. Each account duplicates many/most/all System Folders/Files. E.g. Waste and Redundancy at the very least. You can add as many layers as you want and call them more security, it doesn't necessarily make it good or beneficial, many times it can be bad or worst than having less layers To Protect. Also if your settings are anywhere near mine then you are seeing at least Redundant/Double of most Folders. E.g. In Users/Your account/ Click on App Data, then click Application Data. It's really not necessary to list all the examples of this since you sound experienced enough to see them yourself.

No, each account duplicates a profile directory and that's it. All system folders, files, etc are shared. If settings are duplicated within a single account that's a problem with the app doing that and having less accounts won't help that.

Then lets call it opinion based and we each have our own. Reason being the mere fact that have to constantly get permission for what are fairly common edits, is by it's very nature redundancy without reason. If I ran XP for 10 years in my Own Way/Pathology (whatever you want to call it) and never had a problem, why do I all of sudden have to take twice along with Win7 to accomplish the same thing? That's not efficacy or more effective it's less.

No, they're most definitely there for a reason. The reason is that you shouldn't be doing that often and you're making system-wide changes so there should be some sort of confirmation. There's always a tradeoff for security and in this case UAC trades off less than a second if your time to confirm that you really want to do that. Not much of a tradeoff if you ask me.

Thanks for your advice, once again, remember I'm just replying to you, not trying to make you use my method or judge your computer activities. No offense but you couldn't possibility know this.

Why would you think I'm doing something wrong, just becasue you don't experience the same thing. You can't possibly believe we have identical lifestyles on the computer. No offense, I haven't even provided you any information to make that call, since I was never even on the subject of asking if I should or shouldn't. Once again, remember I'm just replying to you, not trying to make you use my method or judge your computer activities.

I know you're doing something wrong because you're constantly fighting with UAC. Yes, it's a bit of a workflow change, but that's part of learning a new OS. If you want to continue to use a wrench to screw in screws that's on you, but it doesn't make much sense.

Then, this by it's very nature proves we have different settings or lifestyles on our PCs. As I mentioned, even being logged in with Admin rights doesn't not give you full Admin Rights. You either have to log Out, then in as Full Admin or spend time giving blanket Admin rights to many System ini files and/or folders. Hell, even if you Log In as Full Admin there is STILL at least one more level/layer higher, requiring you to give Global Permissions to your Full Admin rights for certain System files/folders.

That's by design and is a good thing, but you should never have to log off as using Run As Administrator works for virtually everything.

The only thing I can think of is somehow my confusion on HOW to achieve this was transmitted into confusion of whether/if/should I do this. It must have been the two hours of sleep I got last night, my apologizes.


I'll try again, could someone please help me create a Full Admin only Win 7 Install?


Thanks for any help or tips. :cheers:


Edit. I'm at least glad there was lots of info in Goolefu about Off Partitioning Program Files, Users, ProgramData and Program Files (x86) to the D partition, made it pretty easy to resolve and accomplish.

There's no confusion, we're just trying to explain to you that what you want to do is very bad and shouldn't be done except as a very last resort. Any time I see a document that says "Disable UAC" the first thing I think is "Great, these developers are f'ing morons".

 

[FishAk]

I agree with the above posters. I use a limited account for normal use, and lock it down even tighter with AppLocker. However, if you feel you must have the highest rights possible, go to Computer Management > Local Users and Groups > Users. Here you will see a list of users for the local machine- including the built-in Administrator. That Administrator account is set to disabled by default. You can enable and use it, to have higher privileges than a normal Admin account, although I'm not sure it will trump a Trusted Installer. Simply disable any other accounts you don't want to use. (I don't recommend this approach)

 

[evilspoons]

Any time I see a document that says "Disable UAC" the first thing I think is "Great, these developers are f'ing morons".

I agree 100%.

Software should be able to work within the security boundaries Microsoft has FINALLY laid out properly for Windows Vista/7. If it doesn't, odds are the developer did it wrong.

I have a remote DVR that, for web access with Internet Explorer 8+, requires you to:
- add it to the trusted domain on Internet Explorer
- enable automatic installation of ActiveX components
(the actual instruction is "turn everything from Disable to Enable in the Custom Level security prompt")
- enable compatibility view universally (old-style IE6 rendering on all pages)
- disable UAC
- disable memory protection
- disable certificate revocation checking
- disable DEP

ALL TO WATCH VIDEO FROM A REMOTE CAMERA!!

Needless to say I don't actually use the damned ActiveX component, it doesn't work very well in Chrome anyway

Every single thing here worked in Windows XP originally, so whoever wrote the program went "perfect! It's done!" instead of going "what the flying @#$% am I doing here".

This kind of software design needs to be punished and stopped. Ask for admin rights during runtime when they're needed, not when the program starts. Store files and settings in local account folders and the user's registry keys. CHECK if you have permissions before doing something instead of crashing or silently failing when you don't have them.

I would continue but my eye is starting to twitch.

 

[hclarkjr]

I've never tried this, nor can I find any info with googlefu, so not exactly sure how to ask it. Nor what kind of potential 'After/During Install' (if it works) I could/would run into. Hope this is at least clear enough to get the idea.

I'm working on trying to create a Windows 7 install with an Administrator activated account only, completely skipping User Creation.

My idea is to Reboot at the User Account Creation prompt. Once the machine reboots it creates a temp Admin account. Is it possible at this point to Unlock the Administrator account, then reboot getting the LogIn Prompt with only the Administrator as a choice?


Thanks for any help or tips.

there are couple of ways to do this, one of them is here http://www.sevenforums.com/tutorials/507-built-administrator-account-enable-disable.html
another way is the way i do it with program called RT7lite, i make custom DVD with no user accounts created therefore running as admin by default

 

[Maverick6969]

OP, Nothinman's comments to you may not be agreeable, the content of his posting in his advice to you is 100% spot on. I suggest you rethink how you view Windows 7 as nagging or annoying. The UAC default setting in Win7 is far less obstrusive compared to Vista. Your desire "create" a lean mean system by deleting the other user accounts (default) is futile. Even if you were to succeed, the net gain to you is ZERO.

 

[abaez]

Anyone know where I can see what causes UAC to trip? I'm getting a UAC prompt everytime I open an mp3 in winamp and it's driving me bonkers. I've done all of the regular stuff people have mentioned in a google search and it STILL happens.

 

[Nothinman]

Anyone know where I can see what causes UAC to trip? I'm getting a UAC prompt everytime I open an mp3 in winamp and it's driving me bonkers. I've done all of the regular stuff people have mentioned in a google search and it STILL happens.

It's most likely permissions on the MP3 or WinAMP wanting to write to it's install directory, which is retarded these days.

 

[abaez]

Why would winamp still need permission if I am running it as admin for all users.

 

[Nothinman]

Why would winamp still need permission if I am running it as admin for all users.

You mean you have that option checked on the shortcut? If so, that may be the reason you're seeing the UAC prompt then because you need to elevate via UAC to run something as admin.

 

[imagoon]

Why would winamp still need permission if I am running it as admin for all users.

All the current versions on Winamp is "UAC compatible" they have been since version 3.5ish. (They started using the MS recommended guidelines at that point.) Only the updater should prompt for UAC to patch the install directory. If you are hitting play and getting a UAC prompt, your MP3s are likely in a folder that your normal user doesn't have permission to. This happens a lot on people that bring over drives from windows XP (did it for 2 of my disks here.) The simple solution is to open the security for the folder, and add yourself as a use with at least read. The better solution (assuming only 1 disk drive) is to put them in your "my music" in "my documents." This doesn't work as well if you have multiple drives. However if you format the the drives in Windows 7 it does set the proper permissions on the root of the disk so that your user can get access in the future without UAC warnings.

 

[abaez]

You mean you have that option checked on the shortcut? If so, that may be the reason you're seeing the UAC prompt then because you need to elevate via UAC to run something as admin.

Wow.. this was it. Thanks. Seems totally backwards.

 

[Nothinman]

Wow.. this was it. Thanks. Seems totally backwards.

Not at all, UAC is there to notify you when something needs admin rights. It's a buffer between you and elevation, so all checking that box does is save you from right-clicking and hitting Run as Administrator.

 

[KamiXkaze]

Already to late on this topic, but yes UAC does add that extra layer of security which most people need.

kXk