Surviving a Windows XP Limited User account

As I mentioned in my last post, it's a good idea to use a "Limited User" account under Windows XP (I haven't experienced Windows Wished'a -- erm, Vista -- so I can't speak for that OS, but chances are it's the same).

But it's so limiting!

You have to login as admin to install software, to install new hardware devices, to setup new internet connections (mostly referring to VPNs, here) -- even to install those bulky Windows Updates!

How do I deal with it?

With much exasperation, to be assured, but windows comes with tools to "make it easier". The main tool I use is "runas". This is a command line tool that takes a variety of options, and lets you run a program as a different user (including admin users). The catches: 1) you almost exclusively have to use it on executable files, and 2) you have to know the other user's password. Which isn't a problem if both user and admin accounts are yours. Also useful, right-clicking an executable file (and a few other file types) offers a "Run as..." option, which is similar but a bit more limited than the runas command line tool.

I use the runas command combined with shortcuts in my quicklaunch menus to launch Windows Explorer, Regedit, and Control Panel under my admin account. This allows me fairly convenient access to these things, though I still have to type my password, which delays access. But it's better than nothing.

To set these shortcuts up, you will need the "Secondary Logon" service to be running (the runas commands rely on this service). The Quicklaunch directory can usually be found at C:\Documents and Settings\{user}\Application Data\Microsoft\Internet Explorer\Quick Launch , where {user} is the name of whichever account you will be using. Alternatively, you can right-click on an empty spot on your quicklaunch toolbar (best is between the last icon and the drop-down arrow that shows the rest of the shortcuts) and click the "Open Folder" option, upon which Explorer will present you with the mentioned directory.

Now, on to exactly which shortcuts I use. In all of the following, {admin} will refer to the name of the admin account you will be logging in under (not your normal user account). When you see (or don't see) the "/env" and "/noprofile" switches for the runas program, they are optional for the most part:

Windows Explorer: Create a new shortcut in your quicklaunch folder and point it to C:\WINDOWS\system32\runas.exe /env /user:{admin} "explorer.exe /e,\"%USERPROFILE%\Desktop\"" This will open a new Explorer window open to the current user's Desktop folder. You can also replace %USERPROFILE%\Desktop with another folder, or, to have My Computer selected, with ::{20D04FE0-3AEA-1069-A2D8-08002B30309D}. The escaped quotes (\") are necessary. For your reference, I've listed some other system folders that you may find convenient to have shortcuts (runas-admin or otherwise) to.

Control Panel: Create a shortcut to C:\WINDOWS\system32\runas.exe /env /user:Root "explorer.exe /e,\"::{20D04FE0-3AEA-1069-A2D8-08002B30309D}\::{21EC2020-3AEA-1069-A2DD-08002B30309D}\"" Again, you have to omit the /noprofile switch for it to work.

Registry Editor: Create a shortcut to C:\WINDOWS\system32\runas.exe /env /noprofile /user:Root regedit (If you don't understand the following paragraph, you may not even need this shortcut) The problem with using regedit through this method is that HKEY_CURRENT_USER is the admin user. You can still edit other users' accounts by finding their tree under the HKEY_USERS key. If I'm not mistaken (and on this point I very well could be), the trees (under HKEY_USERS) referring to actual users have long strings of numbers separated by dashes, the last number group being 100x (where x is a decimal [possibly hex] number).

Services, Device Manager, Event Viewer, and the like This part gets a little trickier. To pull up the system services, for example, under an admin account, I would normally use Start > Run..., then type "services.msc" and click OK. This works under limited accounts, but you can't start/stop/edit services. And, for some reason, you can't use runas with services.msc; it just won't work. There are two workarounds: 1) find the .msc or whatever file that refers to the administrative tool you want to use under the C:\Windows or C:\Windows\System32 folders, right-click, choose "Run as...", and enter your credentials, or 2) Use the Start > Run... option to run

runas /user:{admin} mmc

then, in the resulting window, File > Add/Remove Snap-in... > Add... and select/add whichever tools you want to work with. Not pretty, not easy, but it's there if you need it.

So, there you go. A few tools (derived from one tool) that I use to tweak my system as a Limited User. Hope you found it helpful, and feel free to ask questions or make suggestions (or boast of whatever tools you use) in the comments!

Also, as promised, some additional system folders:

• My Computer: ::{20D04FE0-3AEA-1069-A2D8-08002B30309D}
• Recycle Bin: ::{645FF040-5081-101B-9F08-00AA002F954E}
• Desktop: ::{00021400-0000-0000-C000-000000000046}
• Printers: ::{2227A280-3AEA-1069-A2DE-08002B30309D}
• Dial-up networking: ::{A4D92740-67CD-11CF-96F2-00AA00A11DD9}
• Fonts: ::{BD84B380-8CA2-1069-AB1D-08000948F534}
• Internet Explorer: ::{871C5380-42A0-1069-A2EA-08002B30309D}
• Microsoft Outlook: ::{00020D75-0000-0000-C000-000000000046}
• Network Neighborhood: ::{208D2C60-3AEA-1069-A2D7-08002B30309D}
• Inbox: ::{00020D76-0000-0000-C000-000000000046}
• Subscriptions: ::{F5175861-2688-11d0-9C5E-00AA00A45957}
• URL History Folder: ::{FF393560-C2A7-11CF-BFF4-444553540000}
• Briefcase: ::{85BBD920-42A0-1069-A2E4-08002B30309D}
• Internet Cache Folder: ::{7BD29E00-76C1-11CF-9DD0-00A0C9034933}
• ActiveX Cache Folder: ::{88C6C381-2E85-11D0-94DE-444553540000}
• Control Panel: ::{20D04FE0-3AEA-1069-A2D8-08002B30309D}\::{21EC2020-3AEA-1069-A2DD-08002B30309D}

These were taken from the documentation file for KKMenu 2.8, whose author says:
"Please note, that I have taken the list above from the Aqua-Soft discussions (thanks to hydrostereo and fireball) and I have never tested if all of the items do really work. Please e-mail me in case of any inconveniences to: <email removed>."

Why use a "Limited User" account on Windows?

(Related google search) By default, any Windows XP user accounts that you create are given administrator privileges. Many people leave it this way (and some just use the built-in administrator account), allowing them to install software, modify settings, and otherwise tweak their system as their whims lead them to. Unfortunately, this also gives administrator privileges to ill-intentioned applications, malicious programs, and viruses. Operating under a Limited User account can limit the damage that an accidentally downloaded virus is able to do. Limited User accounts have limited access to the windows registry, read-only access to select system folders (C:\windows, C:\Program Files, and probably others), and non-use access to several system tools (disk defrag, scandisk, add/remove programs, add hardware, and most tools in the Control Panel). Under such lockdown conditions, viruses and bad programs can't really do much, which is good. If you need to install a program...well, you can't, but your admin account can, and you can access that account's privileges either through the runas command or through switching to your admin account. Or, if you're wanting to run an executable program (whose filename ends with .exe), there's the RunAs context menu option. If you're thinking, "Yikes...so, you basically can't do anything?" then you'd be partially correct. Unless you go through your admin account, you can't install programs, uninstall programs, or do anything short of web-browsing and document-editing. Which may be all you need, depending on your circumstances. If you need regular access to locked-down resources, but still want the added security of a Limited User account, you can do as I have and make two accounts on your machine, one for (limited) everyday use and one for admin use. And check out my post, Surviving a Windows XP Limited User account, on making this situation livable ;) As there are plenty of step-by-step guides on how to setup a new user account, I'll let Microsoft themselves guide you through the process.

The best laid plans...

While it appeared that I had found the social bookmarker for me...it appears that that site is dead and abandoned. After waiting 48 hours for my bookmarks to be imported, I sent an email to Spurl.net support asking if the site was, indeed, dead. I also found a post on their support forum in response to an importing delay complaint, which basically said "Spurl is apparently dead and abandoned. Try this site instead." I never got a reply to the email, and, better still, the entire site seems to have been taken down, meaning I couldn't find that post to quote here for you ;) So, back to square one. After searching some Digg and some Google, I stumbled upon Netvouz.com. Remember what my "desirables" were?

1. Hierarchy
2. Easy on the eyes
3. Privacy when I want it
4. Buttons!
5. Import/Export capabilities

Well, Netvous meets all of them satisfactorily. It supports hierarchy in the form of folders (and subfolders -- it only lacks the tree visual representation). It has a google-esque color scheme, which is much better than Del.icio.us's. It supports privacy, but not on a bookmark-by-bookmark basis (all your private stuff and all your public stuff go under completely unique Public and Private folders). Netvouz FireFox buttons are available, though I've not tested them yet. And the import function finished in a matter of seconds over my high-speed connection. So, providing Netvouz doesn't go down in smoke anytime soon, I'll settle here. Also, I found a good RSS Aggregator that I like. It may not meet the "social" aspect...but who cares? :) <<update>> Spurl.net seems to be back up...not sure why I was getting blank pages last time. Here is the post mentioning the death of Spurl. And, seeing that my 'marks still aren't imported, I would tend to agree. Too bad :(