Is it possible to create two administrative user profiles?


  1. Posts : 10
    windows 10
       #1

    Is it possible to create two administrative user profiles?


    *SORRY--just realized this should be in another forum. Not sure how to move but checking with admin now.

    I would like to create two administrator user profiles, one with complete control and one configured with (at least) two limitations:

    1) the inability to move, delete, or otherwise modify executables (or other files, as needed); plan on doing that through making the primary administrator control a given file, and then assigning lesser rights to the secondary administrator.

    2) the inability to enter safe mode, modify the registry, or change the time.

    I want to give the primary administrator complete rights, so if something happens backup etc. is accessible.

    1) First, need to know if it is possible (and won't screw up my system).

    2) If it is, can this be done safely, and through group policy?

    3) Also, can both users share the same programs, file settings, etc.?

    I currrently have Win 10 x64 Home, but am planning to upgrade (the free, fully functional--but nagging) Win 10 Pro to use group policy--it has it, right?

    I read that older versions of Windows allowed you to create a "superuser" profile with advanced properties; if I can't do this in Windows 10, would it be advisable to go back to Win 8 (or whatever version supported that feature)?

    Thank you!
    Last edited by anoukaimee; 09 Jul 2016 at 22:12. Reason: wrong forum
      My Computer

  2. Mystere's Avatar
    Posts : 3,223
    Windows 10 Pro
       #2

    You can't stop a user from entering safe mode. That selection for safe mode happens before the OS even starts (and thus the user even logs in).

    Most other things can be done through group policy, but it's a tedious task making the OS hardened like that. And requires a lot of research on your part.
      My Computer


  3. Posts : 1,093
    Windows 7
       #3

    By design, all Administrator accounts are equal. That has been the case all the way back to the first release of NT in 1993. There is no such thing as primary and secondary administrator accounts. Whatever restrictions you might impose any other administrator can remove or modify. That is an inherent property of an administrator account and cannot be removed.
      My Computer


  4. Posts : 10
    windows 10
    Thread Starter
       #4

    Mystere said:
    You can't stop a user from entering safe mode. That selection for safe mode happens before the OS even starts (and thus the user even logs in).

    Most other things can be done through group policy, but it's a tedious task making the OS hardened like that. And requires a lot of research on your part.
    Yep, I figured it would take a lot of work. Given that I have just like 3 things to tweak, can I start with an administrator profile and scale down (that is, retain the settings other than those three or so I want to keep)? Relatively computer savvy, but never used group policy. But have dl'd Microsoft's spreadsheet with all of the commands.

    Should I just start with the default administrator account and then create another administrator account (and if so, local or MS)? If two administrators, how do I specify which is default?

    I have found a command line that works 100% for locking safe mode. I think it is "bcdedit" something, but can't remember. It works so long as you don't have a recovery environment. Which might not be the most optimal environment. Can a user with restricted security settings (such as described above) delete etc. in safe mode, or is that not a concern?

    Thank you!
      My Computer


  5. Posts : 10
    windows 10
    Thread Starter
       #5

    LMiller7 said:
    By design, all Administrator accounts are equal. That has been the case all the way back to the first release of NT in 1993. There is no such thing as primary and secondary administrator accounts. Whatever restrictions you might impose any other administrator can remove or modify. That is an inherent property of an administrator account and cannot be removed.
    Even when you are 1) working as the primary administrator and 2) modify the permissions of the second administrator? Would you just have to create a low level profile and "scale up" with additional privileges?
      My Computer


  6. Posts : 1,093
    Windows 7
       #6

    A "primary administrator" may remove the rights of a "secondary administrator" but the latter can always take them back. Any rights an administrator does not have he can grant himself. That is an inherent capability of an administrator account.
      My Computer


  7. Mystere's Avatar
    Posts : 3,223
    Windows 10 Pro
       #7

    LMiller7 said:
    By design, all Administrator accounts are equal.
    That's actually not exactly true.

    There is the Local Administrator, then there are accounts added to the Administrators group. A third kind of administrator (not really an admin, but has admin abilities) is often termed "Power User". You can also create accounts that are manually given various permissions (such as installing software) without making them an actual administrator.

    That is what I meant by it being a lot of work, since you're going to have to start with a standard account and add abilities.
      My Computer

  8. Mystere's Avatar
    Posts : 3,223
    Windows 10 Pro
       #8

    anoukaimee said:
    Yep, I figured it would take a lot of work. Given that I have just like 3 things to tweak, can I start with an administrator profile and scale down
    No. You have to start with a standard user and add the permissions you want them to have. Adding a user to the Administrators group gives them full rights to everything, and while you can deny any particular user (even administrators) access to certain things, being an administrator means they could just give themselves access to it again.
      My Computer


 

Related Threads
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd
All times are GMT -5. The time now is 21:31.
Find Us




Windows 10 Forums