Is it possible to restrict the administrator account login times

polomora · 01 Oct 2022

Hello,

I have several family PCs at home. I am the administrator for the PCs and other family users use normal user accounts. A family member wants to have administrator access, which I am willing to grant, but only at certain times of the day, when I'm around to supervise.

The computers are running Windows 10 Home.

Is this possible? I'm aware of the net user <user-name> /time command, to restrict access to user accounts. Can I do something similar for the administrator account?

I've found the following, but the original question wasn't really answered:
https://social.technet.microsoft.com...w7itproinstall

Try3 · 01 Oct 2022

Anything that you set up using your Admin privileges can be changed by anybody else who has Admin privileges.

Admin permission is not needed for "normal" activities.

Is there some specific hurdle that needs to be overcome?
It is possible, just for example, to set up an apparently non-Admin method of running an application that actually requires Admin permission.
Create Elevated App Shortcut without UAC Prompt - TenForumsTutorials
- This would need to be done individually for each required application.
- The method uses Task scheduler and it runs in your Admin user account. So anything that application has access to is covered by the exemption that has been set up.
- It can be useful in some circumstances. I have such a setup to allow me to run Task manager without seeing any Admin prompt when starting it. Other users making use of it could abuse the privilege because they could use Task manager to launch a Cmd prompt which they could then use to grant themselves Admin privileges all the time.

Denis

polomora · 02 Oct 2022

Thanks Denis for the reply.

I would still love to know if it's possible to do what I want to do.
- block the admin account between specific hours and/or days for everyone
- allow access otherwise

This would be a doddle to implement On Linux. Is it even possible on Windows?

Try3 · 02 Oct 2022

polomora said:

I would still love to know if it's possible to do what I want to do.
...
Is it even possible on Windows?

No, because

Try3 said:

Anything that you set up using your Admin privileges can be changed by anybody else who has Admin privileges.

Denis

FreeBooter · 02 Oct 2022

Set Logon Time Limits For Any Account in Windows 10.

AK6DN · 02 Oct 2022

polomora said:

Hello,

I have several family PCs at home. I am the administrator for the PCs and other family users use normal user accounts. A family member wants to have administrator access, which I am willing to grant, but only at certain times of the day, when I'm around to supervise.

Once an account gets admin access they can undo any restrictions that you might have placed on that account.

I once had a teenager who wanted admin access on the family computer. I said no, will not happen.

So I got him his own computer and gave him admin access.

It became unbootable and needed to have the OS completely reinstalled in a couple of days.

So yeah give him admin access and see what happens ...

FreeBooter · 02 Oct 2022

You can always let standard user account run programs with administrative privileges. In this video, i will show you how to allow standard users to run a program with Administrator rights without giving them the password.

polomora · 03 Oct 2022

Thanks for all the replies.
I know that anyone with access to the admin account can change any restrictions to that same account.

But I would like to do it anyway.
The other users ahve been given life-threatening warnings if they abuse it. ;<)

AK6DN · 03 Oct 2022

polomora said:

Thanks for all the replies.
I know that anyone with access to the admin account can change any restrictions to that same account.

But I would like to do it anyway.
The other users ahve been given life-threatening warnings if they abuse it. ;<)

I would make sure that you have an adequate full disk backup/recovery procedure in place (like Macrium Reflect et al) so that if (when) the system becomes unusable due to fiddling you can recover it to the prior usable state.