secure guest account

[Guest Johnfli]

I have XP Pro not attached to a domain.

I have a regualr user account that has admin rights.

 

I want to be able to setup teh guest account NOT to be able to install

programs, or download anythign from teh Internet. or at least not install

anythign from teh Internet.

 

how can I do that?

[Guest Malke]

Re: secure guest account

 

Johnfli wrote:

> I have XP Pro not attached to a domain.

> I have a regualr user account that has admin rights.

>

> I want to be able to setup teh guest account NOT to be able to install

> programs, or download anythign from teh Internet. or at least not install

> anythign from teh Internet.

>

> how can I do that?

 

Do not use the Guest account you see in the User Accounts applet in Control

Panel. The Guest account is a special system account, not one meant for

when you are feeling hospitable. It is disabled by default in Windows XP,

Vista, Linux, Unix, and OS X for a reason.

 

From TechNet:

 

"The Guest account is intended for users who require temporary access to the

system. However, if this account is enabled, a security risk may exist

because an unauthorized user could gain anonymous access to the system

through this account."

 

http://technet.microsoft.com/en-us/library/bb418978(TechNet.10).aspx

 

So if you enabled Guest, disable it now and create a Standard/Limited

(Vista, XP Pro/XP Home) for your visitors. Call the new user account

something like "Visitor".

 

If you have XP Home, you don't have the built-in ability to create

fine-grained limitations if you want them on this account, so use either

MVP Doug Knox's Security Console or the MS SteadyState program to set the

restrictions the way you want. SteadyState supports Vista now.

 

http://www.dougknox.com

http://www.microsoft.com/windowsxp/sharedaccess/default.mspx

More on SteadyState: http://aumha.net/viewtopic.php?t=27570

 

If you have XP Pro, Media Center, Vista Business or Vista Ultimate, you can

use Group Policy to set restrictions (gpedit.msc). Be very careful using

the Group Policy editor; it is completely possible to lock yourself out.

Questions about group policy should be posted here:

 

microsoft.public.windows.group_policy

 

Malke

--

MS-MVP

Elephant Boy Computers - Don't Panic!

FAQ - http://www.elephantboycomputers.com/#FAQ