You can find out about RUNAS and its switches by opening a CMD prompt and typing "runas /?" (without the quotes) and hitting the Enter key. You can place runas in the Target field of the shortcut that a given user uses to run the program. You would use the same syntax that's specified for its use at the CMD prompt. When used this way runas starts up the program and runs it under the credentials you supply. If you use the /SAVECRED switch you only have to specify the credentials the first time the shortcut is used in that account. From then on the program will launch in that account without asking for a password, hence you don't have to tell the user an admin or power user password. (Note: You log in as an admin, find the shortcut in the user profile you want to have the ability to run the program, and you change THAT shortcut.)
Power User is one of the user types that is not presented as a choice when creating a new user in Windows XP's default GUI. You can create Power Users (and several other types of users) by using the alternate Users and Passwords dialog. (Start|Run, type in "control userpasswords2", click on OK.)
To be able to control Access Control Lists through the GUI in Windows XP you need to disable Simple File Sharing on the View tab in the Tools|Folder Options dialog of Windows Explorer. Then, when you right-click on a file or folder or drive you'll be able to get into a security/sharing dialog.
I hesitate to suggest the use of permissions (the ACLs) if you're not really familiar with the way NTFS permissions work. Also, changing the Simple File Sharing feature may not be such a great idea if you're already using this system on a local network. Its behavior will change when you change the Simple File Sharing setting.
But, hey, it's all a learning experience. Whatever way you approach this I strongly suggest keeping notes on exactly what you change and how you change it so that you can reverse your changes if you don't like the way things change.
- prosaic