Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Removing user accounts.


  • Please log in to reply
35 replies to this topic

#1 M332

M332

  • Members
  • 211 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:25 PM

Posted 18 February 2012 - 07:05 PM

I'm tired of my actions being blocked so I just want to leave the administrator account and delete the rest of them since I'm the only one on my pc. I can have only the admin account with these other accounts deleted without it causing any computer problems correct? I believe this is the case but I just want to make dang sure first.

BC AdBot (Login to Remove)

 


#2 LucheLibre

LucheLibre

  • Members
  • 608 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Tennessee
  • Local time:06:25 PM

Posted 18 February 2012 - 07:19 PM

I suggest you don't mess with the User Accounts for this beyond UAC. Have you already tried turning off User Account Control?

If it looks like I know what I'm doing, there's a pretty good chance the only reason for that is because
I once asked someone to run chkdsk /r and a BC Advisor smacked me in the back of the head.

~ LL ~


#3 Zen Seeker

Zen Seeker

  • Members
  • 695 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:05:25 PM

Posted 18 February 2012 - 08:12 PM

I would suggest you have the administrator account and one other with admin rights and a standard user. Use the administrator as a backup account in case something happens to yours. Disable UAC if you must or change it's action first.

You should leave any default windows accounts and just set them to disabled, like the guest account.

Don't use the "User Profiles" menu unless you know what your doing as the control panel--> user accounts and family safety menu is better and will prompt to remove all files and profile folders. If you do open "User Profiles" don't delete "default profile" and you can't delete the account your logged in with.

If your administrator account is disabled from direct login you can also open a command window, run as administrator, and type "net user administrator /active". (No quotes.) Which will allow the administrator to login.

Hope this helps,
Zen

#4 M332

M332
  • Topic Starter

  • Members
  • 211 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:25 PM

Posted 19 February 2012 - 07:20 AM

LL, I don't want to turn off UAC. I have it set on "Default - notify me only when programs try to make changes to my computer". I tried turning off UAC just to see if that would stop the problem after what I tried below did not work but after the computer restart I still had the same issue so I set the UAC back to Default.


ZS, I have a Admin account enabled and a guest account which is not. In the hard drive properties under the security tab I have 4 groups.

Authenticated users
SYSTEM
Administrators
Users

Before my original post here I tried to edit the Users group permissions by check marking the permissions "Full control" and "Modify" but when I clicked Apply it came up with a bunch of file listings that could not be changed so I cancelled the change. I don't login at windows startup since I'm the only user but I typed the entry you gave in the run bar and a black box popped up and disappeared before I could get a look at it. To test if it worked I moved the avast report file aswboot.txt from the hidden program folder C:ProgramData/Avast to the C: Users/Downloads folder which worked fine, but when I tried to move it to the C:Program Files/Avast folder it gave me the "File access denied" popup where I pressed Continue, then it gave me the "Destination Folder Access Denied" popup where I pressed Try Again which did not work where I pressed it again a couple times and it finally worked.

However when I then tried to move the report file back to it's original folder it would not allow it after numerous attempts so I don't understand what's going on. How can I put a stop to this hassle where my computer will do what I tell it to? Thanks for the help so far guys.

#5 Zen Seeker

Zen Seeker

  • Members
  • 695 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:05:25 PM

Posted 19 February 2012 - 03:37 PM

Hi M332,

The command line I posted wasn't really meant to be used in the "run bar" but if you have local admin rights it would still work, you just don't see the reply as the command window that opens closes right after it runs.

In the future type cmd in the "run bar" and then enter. Then type or past the command string in the open command console/window. What you missed seeing was either a success or fail message. You can run it again without issue if youwant to know what the answer is.

I thought you wanted to remove other USER accounts. Like Bob, Bob1, test, etc. Not system or default accounts. Your computer needs these account to do things in the background that you can't or don't know about. (Like making your heart beat or breathing.)

When you copy files and folders from one place to another they pick up the rights and accounts tied to the spot you send them to. When you install a program it uses the proper account to install and setup not only the files and folders but the access, settings and links required for it to be run properly.

As a user account you only have the right and full control to YOUR user folders. This goes for all users for their own account or profile. Everything else is a system, trustedinstaller, or administrative account. Stops you from deleting things you shouldn't, seeing things you shouldn't or things accessingthings they shouldn't.

Inharent permissions, group permissions and user permissions can cross each other out or lock everyone out and that doesn't even consider polices. If you don't know exaclty what you want to do and what that would mean to the other settings and permissions your better off leaving it alone. (Years ago a friend asked for security advice and I gave him the tools and knowledge to do what he wanted. However he then decided that no one but HIS account should be in control of any/all files and folders. He took control of his entire system by ownership. When he proudly emailed me this I told him to save anything he wanted before rebooting that machine. He did and then rebooted only to find out that the system wouldn't get to the login screeen again. He had to reinstall.) Too many automated things happen using the default accounts like system and trustedinstaller and if these accounts don't have the proper access or rights they require you either break the system or compromise it. As the system was denied access to the files and folders needed to allow him to login he made the system unuseable...

I wouldn't play with the folder permissions as what you attempted or want to do would open up the entire system to everyone/all users. In effect removing any security settings for that group and making them equal to administrator. Did you do/try this on a single folder, like "program files", or in the user/group management GUI?

What is it exactly you want to do? Allow any user to add/remove/modify everything? Just YOUR account? And why? The only accounts on a local/non-domain controled system that should have that power is system, trustedinstaller, and administrators.

If you feel you need a folder structure that you can run or copy/save things to then create a folder off the root and only give the accounts you want to have access to it and disable the inherited rights. Anything under this folder will follow the same rules you set on the parent. This is still a risk but better than damaging or changing the default files and folders.

Unless your PC is stand-alone, never to be accessed by any network or user, turning on the login screen and security is a must. If you haven't got a bug yet you will, it's just the nature of the internet these days.

I hope this helps and your able to resolve things.

Zen

#6 M332

M332
  • Topic Starter

  • Members
  • 211 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:25 PM

Posted 19 February 2012 - 07:40 PM

"Access denied" is what I got after trying that in the command window.

I tried that in the user/group management GUI.

What I want to be able to do is what I've been able to do in other windows systems without having to create folder structures as you said in your last reply, which is set my user account where I can move, copy, paste, rename, or delete any folders that I see fit while using windows explorer. That has not got me in trouble in the past as I do not mess with items that I know would screw up the system.

Again I am the only user on this pc. I'm on no network so I've never required a login on my windows systems.

#7 Zen Seeker

Zen Seeker

  • Members
  • 695 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:05:25 PM

Posted 19 February 2012 - 09:28 PM

If you get access denied your not administrator.
Since you don't login you are just a user who's in the administrators group bypassing the login prompt.
This is why I said to run a command window as administrator and THEN paste the command. You should see "The command completed successfully."
(Go to Start --> All programs --> Accessories --> right click "Command Prompt" --> Select "Run as administrator".

When you do this the window that opens runs with the rights of the administrator all commands entered are elevated. So when you paste the string I gave you and enter it won't say access denied.

What this does is enable the administrators account so you can login as the local administrator and not a user or user who is part of the admin group like you are now. Once you login as the administrator you'll be as close to what your asking for as possible on Windows Vista or 7. To put it simply, this isn't Windows 95 or XP. Security has changed. Changing permissions on default folders or groups isn't advisable.

If the computer has access to the internet your on a network. If you don't have UAC, Firewall, AV, etc in place your an easier target to connect to. If your running as the local administrator rather than a user anything you download and install has permission to do what it wants, good or bad. If you connect to a website that has nasty code in JS or Java it will run with the local administrators rights and install who knows what.

So, now that I've explained the steps and why you need to do them, along with the reasons you shouldn't do this, it's up to you.

#8 DavidWJ

DavidWJ

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:25 PM

Posted 20 February 2012 - 02:01 AM

If you get access denied your not administrator.
Since you don't login you are just a user who's in the administrators group bypassing the login prompt.
So, now that I've explained the steps and why you need to do them, along with the reasons you shouldn't do this, it's up to you.


You're absolutely right, playing with folder permissions is a dangerous thing to play with. You also are increasing your attack surface for malware and other nasties. If it is not broken, don't fix it is my policy.

#9 M332

M332
  • Topic Starter

  • Members
  • 211 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:25 PM

Posted 20 February 2012 - 05:04 PM

Right Zen that's why I was trying to figure out how to be acknowledged as the Admin so I would not have the denials. The command line won't paste in there for me where I have to type it out. When I paste it all that shows in the entry is "^V". Oh ok I didn't know about the security difference on win7 compared to the older systems. I have UAC, firewall and Avast running. I understand the risk but I'm careful where I browse and what I install, plus I have Avast WebRep installed on my browser which helps prevent that some what as well.

That said after doing what you listed I'm still getting denied during file transfers in Windows Explorer. Is there anything else you know to try where I can do as I please in Windows Explorer without all the denial hassles or is this just how you believe it's going to be for me with the different protections of win7 from their previous systems? Changing the permissions on folders would not work for me.

On a side note after entering that command line then doing a reboot the login screen came up for me to choose between Admin and User which I have never seen, then when I chose Admin it loaded windows into the default desktop, taskbar, and start menu settings identical to the day I first bought it which scared me half to death as I thought I had lost all my customizations! I didn't know what to do so I restored the computer to an earlier save point where the login screen no longer appears and my desktop, taskbar, and start menu are all customized back the way I had them now much to my relief. Did the command line that you gave me cause the login screen and desktop changes? If so I would have appreciated a heads up about that first because I have never used that command so I didn't know that would happen and that scare had me amped up for half an hour afterward.

#10 hamluis

hamluis

    Moderator


  • Moderator
  • 55,398 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:05:25 PM

Posted 20 February 2012 - 06:07 PM

FWIW: I only have the one account set up on any of my Windows installs, I am the sole user of my systems and I've managed to protect my system from myself via measures other than multiple user accounts :).

And...I backup routinely.

Louis

#11 rotor123

rotor123

  • Moderator
  • 8,093 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:06:25 PM

Posted 21 February 2012 - 06:33 PM

FWIW: I only have the one account set up on any of my Windows installs, I am the sole user of my systems and I've managed to protect my system from myself via measures other than multiple user accounts :).

And...I backup routinely.

Louis


Agreed. Four computers and only one user on each. Nobody uses my computers not even family. They use the Nice I7 I built them.

I never let my Antivirus expire. I'm careful where I go on the Internet. I never Peer 2 peer. I never download free junk except from links here or Videohelp.com where I look for free, and Trialware video software when I'm thinking of new software.
The last time I thought I might have a Virus it turned out to be memory going bad.

Fortune Cookie says: Fortune not Found: Abort, Retry, Ignore?

Sent from my All-In-One Desktop. Perfect for Internet, Not for heavy usage or gaming however.

How Does a computer get Infected? http://www.bleepingcomputer.com/forums/t/2520/how-did-i-get-infected/
Forum Rules,    The BC Welcome Guide

167 @ June 2015


#12 Zen Seeker

Zen Seeker

  • Members
  • 695 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:05:25 PM

Posted 22 February 2012 - 01:25 AM

I just want to leave the administrator account and delete the rest of them

Don't use the "User Profiles" menu unless you know what your doing as the control panel--> user accounts and family safety menu is better and will prompt to remove all files and profile folders. If you do open "User Profiles" don't delete "default profile" and you can't delete the account your logged in with.

I have a Admin account enabled and a guest account which is not.

This was not the case or you you would not have seen Administrator and User when you rebooted.

Right Zen that's why I was trying to figure out how to be acknowledged as the Admin so I would not have the denials

"net user administrator /active". (No quotes.) Which will allow the administrator to login.

What you asked for is what I showed you how to do. The Administrator account is there just like guest but you couldn't use/be it as you didn't have it active. The account your using each day is the User account which also happens to be part of the Admin group which was created the day you installed.

From what you have been saying you wanted to remove all other accounts/profiles and be acknowledged as Administrator. That is exactly what I explained along with some background. As I don't know your level of experience or knowledge I've answered as best I could based on what you posted.

The addition of the login screen after your reboot does mean that the Administrator account was activated and you now had the choice of either being the Administrator or the User. When you logged into the Administrator profile for the first time it needed to be created which is why things took longer and it was like a new install. (It was for that profile.) Had you selected the User account it should have been your normal profile with all your custom settings and folders.

If you had posted at that point we could have tried and tested a few things to see if this was what you wanted and expected as far as permissions and rights are concerned and either migrated your customizations over or see what still might not be working as you wanted. Then you could have deleted the User account when you thought your new Administrator profile was working and had all your settings. Which would finally have fulfilled all the requests you asked for. You could also have done "/active:no" the account again BTW.

If either hamilus or rotor123 have a better idea what your asking for and how to apply it they are welcome to offer assistance but I didn't see any suggestions. I don't claim to have the one or only right answer but I thought I could offer more than just "Don't mess with the UAC."

Taking ownership of all/most folders and files will work as well but has more landmines, which I tried to explain. Its just too easy to BSOD, cripple your system, or make it vulnerable if you don't know what to leave alone. If your not sure what a profile is and why activating the Administrator account would cause the login screen to appear even with what I typed it might be better to just leave it alone.

Wish you the best of luck no matter what you decide to do.
Zen

#13 rotor123

rotor123

  • Moderator
  • 8,093 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:06:25 PM

Posted 22 February 2012 - 11:57 AM

It sounds as if you never created a profile before. It taking longer and then giving you a like new desktop has been the way it works since at least XP. Each user has their own personal folders, settings as if the computer were new.

FWIW............

Even as Administrator level user you'll still have to deal with giving an OK on some file operations.

Zen Seeker's advice was spot on.
I would never think to mention that a new profile is empty.

Another gottcha that can hit with a new profile is if you installed any programs in a different profile for you only rather than anyone can use them then you have to install them into the new profile.

Fortune Cookie says: Fortune not Found: Abort, Retry, Ignore?

Sent from my All-In-One Desktop. Perfect for Internet, Not for heavy usage or gaming however.

How Does a computer get Infected? http://www.bleepingcomputer.com/forums/t/2520/how-did-i-get-infected/
Forum Rules,    The BC Welcome Guide

167 @ June 2015


#14 M332

M332
  • Topic Starter

  • Members
  • 211 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:25 PM

Posted 22 February 2012 - 12:54 PM

Zen there's nothing saying we can't still give the migration of my customizations a shot. I'm game if you are. I entered the Admin text into the command prompt, restarted windows, then chose Admin and got into Windows Explorer to move the Avast report file from the hidden ProgramData/Avast folder to the Program Files/Avast folder and it worked without any interfering popup. Once I saw that it worked without issue as the Admin I got into the start menu then clicked on the pointer button next to the Shutdown button and clicked on Switch User then I chose User and saw that all my customizations were loaded just as you explained. I sure wish I would have thought to try that the first time I got into windows as Admin, and had the realization that the changes were not from a drastic windows error since that would have saved me a lot of stress over nothing, but as I said beforehand I had no experience with switching users so the drastic change back to default windows completely blindsided me.

Ok could we set it up where windows would bootup automatically with me logged in as Admin without the login screen stopping windows from loading on every bootup? Btw I figured out how to paste text into the command prompt. You right click on the cursor and choose paste. I was just pressing Ctrl+V to paste the text which doesn't work.

#15 Zen Seeker

Zen Seeker

  • Members
  • 695 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:05:25 PM

Posted 22 February 2012 - 01:17 PM

Not a problem M332, I just don't want to direct you to something you don't want and I'm still learning how to better communicate my instructions without too much typing or not enough explanation.

If someone else can help you better or step in that's perfectly fine as it's all about helping you. That said I've got to step out for a few hours but I'll be back and reply to you properly. As rotor123 noted even Administrator won't be a perfect solution but its as close as I feel safe to bring you. If it still denies you access t some points it will either be for a good reason, which you should look up, or because you have a bug/virus.

I'm glad to hear that trying it again did exactly as we expected. As long as your stuff is up to date, AV is in place, and firewall is setup it should work fine. I just find that at some point as Admin we cut corners and open things to being exploited. (How many times do e buy a new HDD to use only for backups which we then need/use for day to day and then repeat the process of buying another?)

Anyway, I'll check back by dinner time.

Zen




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users