Windows XP – User Account Setup

Hello,

I am going to be formatting my drive and reinstalling Windows XP, so I am preparing to upgrade my computer security.

One area I am unsure about is the type of user accounts I should use. I have always used an account with administrative privileges. My question is there any significant security advantage by using a ‘lesser’ privileged account for daily use?

Specially, I am curious has to how the account type affects malicious software. Does using a restricted account make it more difficult for a virus/Trojan to function? Or does the restricted account only make it more difficult for the user to execute the malicious code?

As well, I am sharing the computer with my wife who cares little for computer security. She uses the computer for gaming, email, MSN messenger, and internet. Does anyone have any recommendations on what type of account would allow her to do what she wants while protecting her and the PC?

TIA

 

Hey Alastor...Welcome to Wilders!

It is true that running an account with administrative privelages can make your more vulnerable to attacks, because that account has more access to the machine than a standard user account.

My recommendation is this: Use your administrative account only for doing things to your local machine (i.e. adding software, doing scans, configuring, etc..) and use a limited account for everything else.

Set you and your wife up an account and leave it as a limited user. If they are neededing specific access to certain parts of the system, then use the admin account to grant them access.

This will help cut down on the number of nasties that hits your machine.

I hope this helps

 

Is this Home, or Professional?

Is this Home, or Professional? There is a big difference in the two and how accounts are set up.

 

Re: Is this Home, or Professional?

Thanks for the information.

I am running Professional.

 

The first time (and the last time) that I ever got a virus was a learning experience that I will never forget. I was working on a PC's Limited 386 on a Netware 3.1 network. I noticed that the files on my hard drive were ballooning in size, thus filling my hard drive and making it useless. I called the network administrator and told him about the problem. He came up to my office and logged into the network as an administrator with my system. As you can guess, he infected files on the server too, all in areas that my limited account had no rights to. Since then, I have always maintained at least two accounts on systems that I administer. One with my user ID, and the other that has the following format:

admin_myuserid

All administrators on my systems are given IDs similar. That way I can track changes that they make. I never hand out the password to the "Administrator" account. This is a practice that I highly recommend, and I tip my hat to you for asking this question.

 

Thanks for the feedback, I think I will try running a similar naming scheme.

 

A couple of links for you to look at in regards to limited accounts:
Using a Least-Privileged User Accounts
Table of contents, Aaron Margosis' non-admin blog

Regards,

CrazyM