Special Edition Using Microsoft Windows XP Professional (3rd Edition)

For reasons that I can't quite fathom, on Windows XP, Microsoft decided to make all local users members of the Administrators group by default. This may have been to reduce the number of support calls from people who said "My computer won't let me install this new hardware,"but I think it's a very bad idea to have users operate with Administrator privileges on a day-to-day-basis.

The Microsoft Users Accounts tool lets you assign users to either the Administrators group or the Users group, which has very restricted privileges. It also forces you to keep one regular user in the Administrators group, even though the Administrator account is still present (although usually hidden).

If you have a standalone computer or a computer on a workgroup network, I suggest that you do one of the following:

• Set up one account to use as the additional Administrator, use it only for installing software and hardware, and make all of your regular user accounts Limited users.

• Use the Local Users and Groups utility to remove your regular user accounts from the Administrators group, and add them to the Power Users group. This gives your users the ability to change settings like screen resolution without full Administrator power.

To set up Power User accounts, create the accounts using any of the normal means: User Accounts Control Panel, Local Users and Groups in Computer Management, and so on. Then, adjust their group membership by removing membership in the Administrators group and adding membership in the Power Users group. You can do this from the Local Users and Groups computer management too, but here's a trick you can use to make the job easier: