User Accounts

I agree, this is a genuine concern, I've seen cases as far back as Windows 98
where a malicious user (a temp worker) created an addtional account to hide
their activities from the owner of the computer.

Unfortunately an Admin account can in principle do anything it likes, so
there is no total answer. However, you can remove the "Users" icon from
control panel, which will mitigate the risk. Setting auto-logon with
enforced logon will also make it difficult for the meddler to change user.

If you have a network, then MyLogon might be a better solution where the
computer performs a specific task, and thus must retain its settings. This
is designed to allow logon to the network without the settings of the local
computer changing. Thus, there is no need to allow a stand-in to work under
your username and password; they have one of their own.
 >> Stay informed about: User Accounts 

On Sun, 18 Mar 2007 10:39:18 -0600, Bruce Chambers
>RogerF wrote:

>> I am running XP Pro and I am trying to figure out if there is a way to
>> prevent someone from creating their own user account when I am logged on as
>> an administrator. I have had this happen to me and I would like to prevent
>> it in the future.

> How can "someone else" create user accounts, if you're the one whose
>logged in to the computer? Do they knock you unconscious or something?

By any one of several ways to spoof either the system (exploits) or
the user (SE) during the user's logged-in session, as happens
thousands of times a day, all over the world.

That's one of the reasons UAC was added to Vista (or at least, one of
the reasons it is good to have it there).

Just because Fred logs in as Fred, doesn't mean that only things Fred
wanted to do will happen during Fred's logged-in session...



>-------------------- ----- ---- --- -- - - - -
Running Windows-based av to kill active malware is like striking
a match to see if what you are standing in is water or petrol.
>-------------------- ----- ---- --- -- - - - -
 >> Stay informed about: User Accounts 

Ian wrote:
> I agree, this is a genuine concern, I've seen cases as far back as Windows 98
> where a malicious user (a temp worker) created an addtional account to hide
> their activities from the owner of the computer.
>
> Unfortunately an Admin account can in principle do anything it likes, so
> there is no total answer. However, you can remove the "Users" icon from
> control panel, which will mitigate the risk. Setting auto-logon with
> enforced logon will also make it difficult for the meddler to change user.
>
> If you have a network, then MyLogon might be a better solution where the
> computer performs a specific task, and thus must retain its settings. This
> is designed to allow logon to the network without the settings of the local
> computer changing. Thus, there is no need to allow a stand-in to work under
> your username and password; they have one of their own.
>
>

As you are replying to a thread from two days ago, could you please
follow usenet custom and quote the post you are replying to? it makes it
SO much easier for the majority of users who post and read here using a
news reader rather than the clunky web interface....
thank you.

http://dts-l.org/goodpost.htm
http://www.netmeister.org/news/learn2quote.html
 >> Stay informed about: User Accounts 

>>>>>>>> RogerF wrote:
>>>>>>>>> I am running XP Pro and I am trying to figure out if there is a way to
>>>>>>>>> prevent someone from creating their own user account when I am logged on as
>>>>>>>>> an administrator. I have had this happen to me and I would like to prevent
>>>>>>>>> it in the future.
>>>>>>>>>
>>>>>>>>>
>>>>>>>>>How can "someone else" create user accounts, if you're the one whose
>>>>>>>>>logged in to the computer? Do they knock you unconscious or something?
>>>>>>>>>Do they threaten you with bodily harm if you don't step aside and let
>>>>>>>>>them use your computer and account? This sounds like the sort of
>>>>>>>>>problem that should be turned over to law enforcement personnel; there's
>>>>>>>>>certainly no technical solution.
>>>>>>>>>
>>>>>>>>>--
>>>
>>>Bruce Chambers
>>>>>>>
>>>>>>>Help us help you:
>>>>>>>http://dts-l.org/goodpost.htm
>>>>>>>http://www.catb.org/~esr/faqs/smart-questions.html
>>>>>>>
>>>>>>>They that can give up essential liberty to obtain a little temporary
>>>>>>>safety deserve neither liberty nor safety. -Benjamin Franklin
>>>>>>>
>>>>>>>Many people would rather die than think; in fact, most do. -Bertrand Russell
>>>>>>>
>>>>>>>On Sun, 18 Mar 2007 10:39:18 -0600, Bruce Chambers
>>>>>>>>RogerF wrote:
>>>>>>>
>>>>>>>>> I am running XP Pro and I am trying to figure out if there is a way to
>>>>>>>>> prevent someone from creating their own user account when I am logged on as
>>>>>>>>> an administrator. I have had this happen to me and I would like to prevent
>>>>> it in the future.
>>>>>>
>>>>>>> How can "someone else" create user accounts, if you're the one whose
>>>>>>logged in to the computer? Do they knock you unconscious or something?
>>>>>
>>>>>>By any one of several ways to spoof either the system (exploits) or
>>>>>>the user (SE) during the user's logged-in session, as happens
>>>>>>thousands of times a day, all over the world.
>>>>>>
>>>>>>That's one of the reasons UAC was added to Vista (or at least, one of
>>>>>>the reasons it is good to have it there).
>>>>>>
>>>>>>Just because Fred logs in as Fred, doesn't mean that only things Fred
>>>>>>wanted to do will happen during Fred's logged-in session...
>>>>>>
>>>>>>
>>>>>>
>>>>>-------------------- ----- ---- --- -- - - - -
>>>>>>>Running Windows-based av to kill active malware is like striking
>>>>>>>a match to see if what you are standing in is water or petrol.
>>>>>>>>-------------------- ----- ---- --- -- - - - -
>>>>>>>
>>>>>>>
>>>>>>>I agree, this is a genuine concern, I've seen cases as far back as Windows 98
>>>>>>>where a malicious user (a temp worker) created an addtional account to hide
>>>>>>>their activities from the owner of the computer.
>>>>>>>
>>>>>>>Unfortunately an Admin account can in principle do anything it likes, so
>>>>>>>there is no total answer. However, you can remove the "Users" icon from
>>>>>>>control panel, which will mitigate the risk. Setting auto-logon with
>>>>>enforced logon will also make it difficult for the meddler to change user.
>>>>>
>>>>>>>>>>If you have a network, then MyLogon might be a better solution where the
>>>>>>>>>computer performs a specific task, and thus must retain its settings. This
>>>>>>is designed to allow logon to the network without the settings of the local
>>>>>>computer changing. Thus, there is no need to allow a stand-in to work under
>>>>>>your username and password; they have one of their own.
>>>>>
>>>>>>Ian wrote:
>>>>>>> I agree, this is a genuine concern, I've seen cases as far back as Windows 98
>>>>>>> where a malicious user (a temp worker) created an addtional account to hide
>>>>>>> their activities from the owner of the computer.
>>>>>>>
>>>>>>> Unfortunately an Admin account can in principle do anything it likes, so
>>>>>>> there is no total answer. However, you can remove the "Users" icon from
>>>>>>> control panel, which will mitigate the risk. Setting auto-logon with
>>>>>>> enforced logon will also make it difficult for the meddler to change user.
>>>>>>>
>>>>> If you have a network, then MyLogon might be a better solution where the
>>>>> computer performs a specific task, and thus must retain its settings. This
>>>>> is designed to allow logon to the network without the settings of the local
>>>>> computer changing. Thus, there is no need to allow a stand-in to work under
>>>>> your username and password; they have one of their own.
>>>>>
>>>>
>>>>
>>>>As you are replying to a thread from two days ago, could you please
>>>>follow usenet custom and quote the post you are replying to? it makes it
>>>>SO much easier for the majority of users who post and read here using a
>>>>news reader rather than the clunky web interface....
>>>>thank you.
>>>>
>>>>http://dts-l.org/goodpost.htm
>>>>http://www.netmeister.org/news/learn2quote.html


No, I will not.

What is more, I refuse to even read, let alone reply to, posts of this kind.

Gordon, if your newsreader cannot handle posts in some kind of hierarchical
order, then perhaps you should change your software so you don't need to keep
repeating earlier posts to the point where the whole thread becomes
illegible. This IS 2007, after all.

All together now:
"On the First Day of Christmas, My True Love Sent to Me..."
 >> Stay informed about: User Accounts