User Accounts

Yes, just like your local bank, Windows can manage accounts. User accounts or accounts for the users of your computer are a feature you can choose to ignore. But, particularly if more than one person uses your computer they do offer some advantages.

So, what do they help you do? Well, each Windows user account can have its own area to store files, its own programs and many of its own settings - including things like the picture on the desktop (did you know you can choose your own picture as the background on the Windows desktop?) or sounds (you know, like the default "dingy dingy ding, ding ding" sound when you turn on your computer).

Another important feature of user accounts is security. You can have accounts that 'can do anything' or accounts that have limited privilege - like only allowed to see their own files, not those of other users. Whereas an account set up as a 'can do anything' account are highly privileged and so can see and read and change the files of any user account. This security feature is used extensively by companies that run Windows to ensure individual employee files are protected from deliberate or accidental changes and deletions and of course to protect privacy (just like in a bank, you wouldn't expect other bank customers to be able to look at the details of your account!) Windows calls the 'can do anything' user accounts 'computer administrator' accounts and those that are limited it calls 'Limited.'

In the home, user accounts might be set up for the family members that use the computer for example. My own computer has user accounts for my wife and me. Our daughter is a little young to need an account yet, but she too will have an account in a year or two.

How Do You Create User Accounts?

User accounts are quite straight forward to create. Here are the things its good to know before you begin - actually the first is the only thing you need to know:

• What name(s) are you going to user for your accounts? - For example, my user account is simply called 'Mark'.
• Do you want to take advantage of different security restrictions? - For example, give other users restricted privilege to read, update or delete other users files - even by accident.
• Do you want to protect your user accounts with a password or PIN? - This would stop someone else accidentally or otherwise using another user's account; if you do, you need to think of at least your own password.

Let's use an example. Perhaps you want three user accounts for members of the household: Joe, Jenny and Marlon. Jenny will have an administrator account, those that can do anything and Joe and Marlon will have a limited privilege accounts. For Jenny and Joe's accounts we want to have a password, but we won't create a password for Marlon's account. You should expect to have at least one account with administrator privilege, as this is the only privilege level that allows you to add new accounts for example. A good security oriented decision by-the-way is that that all of the user accounts used for day-day activity are limited and you have a separate account set up for computer administration - see the User Accounts and Internet Security section for details on why you might do this.

Once you have this information you can create new accounts using the 'User Accounts' section of Control Panel.

Click the User Accounts option and you'll be presented with three main options:

• Change an account
• Create a new account
• Change my picture

 

 

 

 

 

 

 

Choose, 'Create a new account' and you'll be taken through a two step 'Wizard' that asks you to provide the name of the account and the account type - 'Computer administrator' or 'Limited'. To move between the steps you click the 'Next >' button or if you want to go back and change the account name you can click the '< Back' button. You'll see in the pictures, I'm adding 'Marlon' as a 'Limited' account.

 

 

 

 

 

You go through the new account Wizard for each user you want to add.

Next time you start Windows after adding the accounts you will be presented with the Windows XP welcome screen and a list of the user accounts you created. Click on one of the accounts, enter the password that you provided and voila - your own section of Widows is created with your own space for documents and your own desktop background image (the default Windows one until you change it yourself).

User Accounts and Internet Security

There is another important advantage of user accounts, that is, the ability to improve your security against internet attacks like viruses. Of course you should have your firewall turned on, have an anti-virus product installed and up-to-date and get updates for Windows itself from Windows Update - the three most important thing you need to do to protect your computer from those with malicious intent. But, lets imagine for a moment that you computer has been infiltrated by a virus that wants to install a new modem connection on your computer to dial an expensive premium rate service - of course without your knowledge. If you are logged on with administrator privilege and the virus gets to run while you are logged on - it too has administrator privilege (as far as Windows is concerned its running on your behalf) and so could indeed go about its ugly work. If you were logged on with limited privilege - it would be unable to add or change a modem connection and you will have foiled its evil little plan. ha ha! So, all you need to do is give everybody limited privilege accounts and you've added another level of defence - right? Well, almost.

Windows actually allows multiple user accounts to be used at any one time. Try this little experiment, we're going to right mouse click a program on the start menu and examine the menu list that appears:

• Open the Start menu (click the Start button)
• Let go of the mouse button so the menu stays but you have no mouse buttons pressed
• Move you mouse over a program on the left hand list of the menu, e.g. Windows Media Player or Internet Explorer
• Hold down a Shift key on the keyboard
• Press the right mouse button

Look at the right mouse button menu that appears. You should see 'Run as.' as the second menu item. This allows you to run a program under a different user account - like those for other members of your household.

So, why would you want to do this? The most common reason I know of is in cases where you are running in a limited privilege user account and need to run a program with elevated privilege - that is with administrator privilege. Often the setup programs that install new applications need to run with administrator privilege for example. In this case 'Run as.' is your friend, allowing you to enter a different user account name and password that will be used to run the program.

With the default installation of Windows XP Professional or Windows XP Home there is always at least one user account on your computer, with the name of 'Administrator' and a blank password (that is, no password required). If you have added no user accounts yourself and when you start your computer it simply shows you the Windows desktop with Start button etc. then you are actually logging on using this default account. As you can probably gather from the name of the account, it is a user account with administrator privilege - so highly privileged to do anything on your computer.

Let's go back to our earlier scenario the virus that wants to create a new modem connection. If you are logged on using a limited privilege account, like the 'Marlon' account we created earlier, the virus will not be able to create the modem connection using 'Marlon' but it might try logging on as 'Administrator' with no password - something that will work on most Windows XP computers. This account does have the ability to create the modem account and so the virus can go about its dirty work - doh!

You can deal with this problem of a hidden, password free administrator account by either disabling the administrator account on Windows XP Professional or by adding a hard to guess password to the account on either Windows XP Professional or Windows XP Home.

Creating a Password for the Administrator Account

If you have added user accounts to Windows XP, when you see the Welcome screen as your turn on your computer you will not see 'Administrator' in the list - by default Windows hides this user account. To make it appear in:

• Widows XP Professional - press the three key combination Control (or Ctrl) + Alt + Delete (or Del) all at the same time, twice. Windows will present you with a different way to login to Windows using a dialog box where you can type a user name and a password. At this dialog box enter 'Administrator' as the user, leave the password blank and press 'OK'
• Windows XP Home - you will need to re-boot your computer and activate Windows 'Safe Mode.'  This mode is there as a precaution in-case something goes wrong with your computer and it won't start in its regular mode. From safe mode you can logon to the administrator account. So, tell your computer to 'Restart' (Start menu, choose 'Turn Off Computer' and then press 'Restart.' As the screen goes black to signify the beginning of the computers start-up process hold down the F8 key (on the top row of your keyboard). Windows will eventually present you will a black screen with options in white text. Use the up-down cursor keys to choose 'Safe Mode' and press 'Enter.' When Windows starts you will probably notice the screen text looks a lot bigger, but you should see 'Administrator' as an option to log-on, choose it.

At this point you should be logged on as administrator. The only thing we need to is go to user accounts (Start, Control Panel, User Accounts), choose 'Change an account', choose 'Administrator', then 'Create a password'. This will give you a window with three places to enter text, asking you to:

• Type a new password
• Type the new password again to confirm
• Type the word or phrase to use as a password hint

 

 

 

 

 

(Remember to read our section on choosing strong Passwords.)

So, choose an appropriate password and enter a hint that will help you remember what the password is (without allowing someone else to guess the password) and you're done.

You can now press the 'Create password' button and either log-off if you are running Windows XP Professional or restart in normal mode if you are running Windows XP Home.

You may never want to use the 'Administrator' account, but knowing that it has a hard to guess password also significantly reduces the chances of it being used by malicious software J