Restricting other users



Joe
07-09-2005, 11:53 PM
Hi,
I am using a home PC and as a father I want to prevent my kids from logging
on to the computer. Now I've tried locking it, but this prevents 'fast-user
switching' and also my bloody kids will reboot the computer in order that
they can log-on and play games!
Is there any way of locking the computer that still allows 'fast user
switching' to be enabled while preventing everyone who is not an
administrator from loggin on?
Thanks

Roger Abell
07-09-2005, 11:53 PM
You did not mention the operating system, but as you did mention
fast user switching I will guess that you have XP.
You also evidently have the machine set to automatically log in
when it is started, which by the way is very insecure.
If you do not yet have multiple accounts, then as soon as you
use the User Accounts applet of control panel to define more
you will likely start needing to log into the machine upon start,
which instead will present a Welcome screen that looks pretty
much the same as the switch user selection screen.
If your machine does still automatically log in after there are
multiple accounts check in the help system for "automatic logon".
If you had been using the built-in Administrator for login, then
after forcing the Welcome screen to show, this account will not
be one of the available selections. Not to worry. Just press
alt-cntrl-del-del in order to get the older, main login dialog and
there enter the name and password. (note: this works on the
Welcome screen only, not on the switch-user interface.)
There are ways to get the account to be shown permanently on
the Welcome screen if this is the case.

To prevent use without knowing an account, make sure that you
set new passwords that are not simple to guess, and do this on
all accounts. No one will use the machine without having an
account. Now, for XPs that come preinstalled there is one more
thing you should do - set password on the built-in Administrator
account. Much of the time this account has a blank password
on systems shipped from the manufacturer, and most kids know
of this and of how to make use of the fact. To set this password
reboot the machine into safe mode (this is done by pressing F8
durng the boot sequence) and then use normal means to give the
Administrator account a password,

Finally, you should check, if there were already multiple accounts,
that none of them is a member of Administrators unless you want
it to be one. One simple way to do this in all XP editions is to
Start / Run and enter cmd to get a command prompt, and there
enter in the command
net localgroup Administrators
which will list out all accounts in this group.

For more information, the newsgroup
microsoft.public.windowsxp.security_admin
would be a great newsgroup for you to visit.

--
Roger Abell
Microsoft MVP (Windows Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Joe" <Joe@discussions.microsoft.com> wrote in message
news:22159394-BE27-43BD-916D-5D9525949C28@microsoft.com...
> Hi,
> I am using a home PC and as a father I want to prevent my kids from
logging
> on to the computer. Now I've tried locking it, but this prevents
'fast-user
> switching' and also my bloody kids will reboot the computer in order that
> they can log-on and play games!
> Is there any way of locking the computer that still allows 'fast user
> switching' to be enabled while preventing everyone who is not an
> administrator from loggin on?
> Thanks

Joe
07-09-2005, 11:53 PM
Hi Roger,
Thanks for your help but maybe i should have been more specific.
I am currently running XP Home edition and when i turn my computer on it
shows a welcome screen. On the welcome screen is my sign-in name 'dad' and i
am the administrater. Also there are the names of my kids and we each have to
put in our password to enter our username and settings. I am the only
administrater, the kids have limited accounts.
What i want to do is 'lock' the computer so that they are unable to use it
sometimes. For instance if they have been bad and a punishment of no games is
ordered, then i want to be able to set a password that prevents them from
logging on while i am out of the house.
i found out that by turning 'fast user switching' off i could press
'windows+L' which locks it, but my irritating son soon realised that by
rebooting the computer it resets to the normal welcome screen and he can log
in as normal!
This is kind of annoying. So please, is there anyway that i can temporarily
lock the PC when the kids are bad?!
Thanks

Paul Adare
07-09-2005, 11:53 PM
In article <EFAFFA7B-26B2-4585-814B-D8DFEDACEED3@microsoft.com>, in the
microsoft.public.security news group, =?Utf-8?B?Sm9l?=
<Joe@discussions.microsoft.com> says...

> This is kind of annoying. So please, is there anyway that i can temporarily
> lock the PC when the kids are bad?!
>

Log in as yourself, open Computer Management, open Local Users and
Groups, open Users, right-click the account, click Properties, then
click Account is disabled. Unclick it when the punishment period is
over.

--
Paul Adare
MVP - Windows - Virtual Machine
http://www.identit.ca/blogs/paul/
"The English language, complete with irony, satire, and sarcasm, has
survived for centuries without smileys. Only the new crop of modern
computer geeks finds it impossible to detect a joke that is not clearly
labeled as such."
Ray Shea

Roger Abell
07-09-2005, 11:53 PM
I see. Boy did I ever make some wrong assumptions.
Paul has you covered with info on your best alternative.

--
Roger
"Joe" <Joe@discussions.microsoft.com> wrote in message
news:EFAFFA7B-26B2-4585-814B-D8DFEDACEED3@microsoft.com...
> Hi Roger,
> Thanks for your help but maybe i should have been more specific.
> I am currently running XP Home edition and when i turn my computer on it
> shows a welcome screen. On the welcome screen is my sign-in name 'dad' and
i
> am the administrater. Also there are the names of my kids and we each have
to
> put in our password to enter our username and settings. I am the only
> administrater, the kids have limited accounts.
> What i want to do is 'lock' the computer so that they are unable to use it
> sometimes. For instance if they have been bad and a punishment of no games
is
> ordered, then i want to be able to set a password that prevents them from
> logging on while i am out of the house.
> i found out that by turning 'fast user switching' off i could press
> 'windows+L' which locks it, but my irritating son soon realised that by
> rebooting the computer it resets to the normal welcome screen and he can
log
> in as normal!
> This is kind of annoying. So please, is there anyway that i can
temporarily
> lock the PC when the kids are bad?!
> Thanks

PA Bear
07-09-2005, 11:53 PM
What ever happen to the word "No"...and backing it up?

Roger Abell wrote:
> I see. Boy did I ever make some wrong assumptions.
> Paul has you covered with info on your best alternative.
>
>> Hi Roger,
>> Thanks for your help but maybe i should have been more specific.
>> I am currently running XP Home edition and when i turn my computer on it
>> shows a welcome screen. On the welcome screen is my sign-in name 'dad'
>> and
>> i am the administrater. Also there are the names of my kids and we each
>> have to put in our password to enter our username and settings. I am the
>> only administrater, the kids have limited accounts.
>> What i want to do is 'lock' the computer so that they are unable to use
>> it
>> sometimes. For instance if they have been bad and a punishment of no
>> games
>> is ordered, then i want to be able to set a password that prevents them
>> from logging on while i am out of the house.
>> i found out that by turning 'fast user switching' off i could press
>> 'windows+L' which locks it, but my irritating son soon realised that by
>> rebooting the computer it resets to the normal welcome screen and he can
>> log in as normal!
>> This is kind of annoying. So please, is there anyway that i can
>> temporarily
>> lock the PC when the kids are bad?!
>> Thanks

Paul Adare
07-09-2005, 11:53 PM
In article <#cjDo5WZFHA.3272@TK2MSFTNGP14.phx.gbl>, in the
microsoft.public.security news group, PA Bear <PABearMVP@gmail.com>
says...

> What ever happen to the word "No"...and backing it up?
>

Last time I checked folks don't come to this news group for parenting
advice.

--
Paul Adare
MVP - Windows - Virtual Machine
http://www.identit.ca/blogs/paul/
"The English language, complete with irony, satire, and sarcasm, has
survived for centuries without smileys. Only the new crop of modern
computer geeks finds it impossible to detect a joke that is not clearly
labeled as such."
Ray Shea

PA Bear
07-09-2005, 11:53 PM
Paul Adare wrote:
> In article <#cjDo5WZFHA.3272@TK2MSFTNGP14.phx.gbl>, in the
> microsoft.public.security news group, PA Bear <PABearMVP@gmail.com>
> says...
>
> > What ever happen to the word "No"...and backing it up?
> >
>
> Last time I checked folks don't come to this news group for parenting
> advice.

Sorry but that's exactly what OP was asking about.
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE) & Security

Roger Abell
07-09-2005, 11:53 PM
"PA Bear" <PABearMVP@gmail.com> wrote in message
news:uVo%235agZFHA.796@TK2MSFTNGP09.phx.gbl...
> Paul Adare wrote:
> > In article <#cjDo5WZFHA.3272@TK2MSFTNGP14.phx.gbl>, in the
> > microsoft.public.security news group, PA Bear <PABearMVP@gmail.com>
> > says...
> >
> > > What ever happen to the word "No"...and backing it up?
> > >
> >
> > Last time I checked folks don't come to this news group for parenting
> > advice.
>
> Sorry but that's exactly what OP was asking about.

In some ways yes, it was, but what was actually asked was
> Is there any way of locking the computer that still allows 'fast user
> switching' to be enabled while preventing everyone who is not an
> administrator from loggin on?

--
Roger

Paul Adare
07-09-2005, 11:53 PM
In article <uVo#5agZFHA.796@TK2MSFTNGP09.phx.gbl>, in the
microsoft.public.security news group, PA Bear <PABearMVP@gmail.com>
says...

> Paul Adare wrote:
> > In article <#cjDo5WZFHA.3272@TK2MSFTNGP14.phx.gbl>, in the
> > microsoft.public.security news group, PA Bear <PABearMVP@gmail.com>
> > says...
> >
> > > What ever happen to the word "No"...and backing it up?
> > >
> >
> > Last time I checked folks don't come to this news group for parenting
> > advice.
>
> Sorry but that's exactly what OP was asking about.
>

No, he was not. He was asking for a technical solution to a technical
problem. It is not your place nor my place to offer parenting advice.
That isn't the purpose of this news group. If you feel the need to offer
unsolicited advice on parenting, there are a ton of other areas on the
Internet where that kind of advice is more appropriate.
You're an MVP for security, not for parenting.

--
Paul Adare
MVP - Windows - Virtual Machine
http://www.identit.ca/blogs/paul/
"The English language, complete with irony, satire, and sarcasm, has
survived for centuries without smileys. Only the new crop of modern
computer geeks finds it impossible to detect a joke that is not clearly
labeled as such."
Ray Shea

Joe
07-09-2005, 11:53 PM
Hi,
Firstly it is not a disipline problem as such, instead the problem is an
inept Nanny. Secondly I'm afraid I still dont understand what you mean when
you say:

Log in as yourself, open Computer Management, open Local Users and
Groups, open Users, right-click the account, click Properties, then
click Account is disabled. Unclick it when the punishment period is
over.

I just cant seem to work out how to open 'local users and groups' within a
program i found called computer management, in a file called admin tools.
Thanks

PA Bear
07-09-2005, 11:53 PM
Paul Adare wrote:
<snip>
> You're an MVP for security, not for parenting.

And your an MVP for VM, not an arbiter of the behaviour of other MVPs, Paul.

Truce.

Paul Adare
07-09-2005, 11:53 PM
In article <u0f2ykuZFHA.3808@TK2MSFTNGP09.phx.gbl>, in the
microsoft.public.security news group, PA Bear <PABearMVP@gmail.com>
says...

> Paul Adare wrote:
> <snip>
> > You're an MVP for security, not for parenting.
>
> And your an MVP for VM, not an arbiter of the behaviour of other MVPs, Paul.

So you get to post what you like even if it is totally off-topic, but
I'm not accorded the same privileges? Is that how this works?

This is a technical news group, with an obvious focus on security.
Responding to a technical question with suggestions on how the OP should
parent his or her children is off topic for this group and not helpful.

If you have a problem with what I've posted in this thread, feel free to
complain to your lead.

--
Paul Adare
MVP - Windows - Virtual Machine
http://www.identit.ca/blogs/paul/
"The English language, complete with irony, satire, and sarcasm, has
survived for centuries without smileys. Only the new crop of modern
computer geeks finds it impossible to detect a joke that is not clearly
labeled as such."
Ray Shea

Roger Abell
07-09-2005, 11:53 PM
Joe,

You may be at a disadvantage here as many people in this newsgroup
are using server and pro versions, and home edition has some specific
peculiarities.

The Local Users and Groups node in Computer Management to which
Paul made reference may be started using
lusrmgr.msc
entered at Start / Run while for the Computer Management interface
one would enter
compmgmt.msc

If I recall correctly from my extremely limited time seeing Home edition,
the logical routes to manage a user account steer you away from these
interfaces. Hopefully running these .msc's might get you right there.

Also, to disable an account named Tommy one may at a cmd prompt
enter the command
net user tommy /active:no
If you were to Start / Run cmd and in the cmd window enter
net help user
you will get a list of info, showing /active:no may be reversed with
use of /active:yes
If you have three kid, you can use notepad to place /active:no lines
for each in a file that you save with a .bat extension, and a similar
reversing bat file where /active:yes is used. Then, double-clicking
on these would run the net user command for all of them.

--
Roger Abell
Microsoft MVP (Windows Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Joe" <Joe@discussions.microsoft.com> wrote in message
news:E6478ECF-52DE-4D0A-8F5A-AE385A52E3C1@microsoft.com...
> Hi,
> Firstly it is not a disipline problem as such, instead the problem is an
> inept Nanny. Secondly I'm afraid I still dont understand what you mean
when
> you say:
>
> Log in as yourself, open Computer Management, open Local Users and
> Groups, open Users, right-click the account, click Properties, then
> click Account is disabled. Unclick it when the punishment period is
> over.
>
> I just cant seem to work out how to open 'local users and groups' within a
> program i found called computer management, in a file called admin tools.
> Thanks
>

Christian
07-09-2005, 11:54 PM
If you can go into the BIOS there should be a Security Tab with a password
feature. Then if your child tries to reboot the computer then the computer
password not Windows XP known only to you should work for you.

"Joe" <Joe@discussions.microsoft.com> wrote in message
news:22159394-BE27-43BD-916D-5D9525949C28@microsoft.com...
> Hi,
> I am using a home PC and as a father I want to prevent my kids from
> logging
> on to the computer. Now I've tried locking it, but this prevents
> 'fast-user
> switching' and also my bloody kids will reboot the computer in order that
> they can log-on and play games!
> Is there any way of locking the computer that still allows 'fast user
> switching' to be enabled while preventing everyone who is not an
> administrator from loggin on?
> Thanks


Restricting other users