Windows XP Local Users and Groups

Subscriber Beth Peacock wrote with a number of simple questions. Of course, the answers to simple questions are not always so simple...

Hi Terry,
I went to My Computer > computer management > (local) users & groups > guests.

I saw that the guest[s] had the same access as I do as the administrator. My password is saved on my pc, so I don't have to key it in every time. How can I make access by anyone else impossible?

Also, under System Summary, I noticed that my total physical memory us 261,616KB; available is 107,856KB. Total Virtual memory is 894,296 KB; available is 592,152KB. Page File Space is 632,680.
Should I be thinking of more memory yet?

Thank YOU, Terry!!!
Beth Peacock

Beth has some really good questions that make us look at the way Windows handles user ID's and memory. First, let's take a look at the different types of user groups — Guests versus Administrators user groups.

Windows XP actually has a couple more types of users, but the only additional user type that is enabled by default is the Limited User profile.

My initial challenge, though, was to figure out how Beth had gotten to this dialog box she mentioned (there are several ways). She gave me the route but not the starting point.

I quickly found it:

1. Click on the Start Menu
2. Right-click on My Computer
3. Select "Manage", which will open the Computer Management dialog box
4. Click on Local Users and Groups. Actually, I prefer to click on the + expansion box just to the left of Local Users and Groups. This will also show me the entries for Users and for Groups, but it will allow me to change between them more easily

Alternatively, I could have gotten to the same window via Control Panel, Performance and Maintenance, Administrative Tools, and finally Computer Management.

After selecting Local Users and Groups, we can see all the different types of user groups (pre-defined classifications of users with different capabilities) that are available in Windows XP Professional. Unfortunately, XP Home doesn't offer the Local Users and Groups option in Computer Management, although the other functions are there.

If we click on Users in the left panel, we see a list of the users that are set up on this computer. You will not see all these users listed on the Windows XP logon screen. If you have Guest disabled, it won't show up. It also will not show up if you have the Guest account turned off, which you can do via Control Panel, User Accounts.

Administrator will only show up on that login screen if you're in Safe Mode (although you can Control-Alt-Delete twice to get a different login screen, where you can type the user name instead of picking an icon).

At this point, double-click on the Guest user, and you should see the Guest Properties dialog box. Be sure that you have "User cannot change password" checked.

The second tab is important for security and is where Beth has a problem. The Guests user should only be a member of the Guests group.

In Beth's case, Guests was a member of Guests but was also a member of Administrators, which could cause (or be a result of) some severe security problems. On this tab, Beth needs to select the Administrators group and then click on the Remove button, followed by Apply.

As a comparison, the following "tas Properties" dialog box is the user dialog box for my normal logon ID. As you can see, a regular user should be able to change their password.

The Member Of tab for tas Properties shows that my ID is a member of the Administrators group and a member of the Debugger Users group. I've forgotten what application I installed that created the Debugger Users group — it doesn't exist on my desktop computer that also has Windows XP Professional.

Unfortunately, the change on the Guest Properties dialog box isn't all that Beth needs, given what she said she wanted to do.

In article To Use a Password or Not, I'll respond to her questiton about passwords and access by others.

Copyright © 2007-2008 Terry A. Stockdale. All rights reserved.