Setting XP User Accounts:  A Handout

Eric Moore
Computer Users Group of Greeley
May 13, 2006

Terms and Definitions
account:  A record of a user's right to login and use Windows XP.  It is validated when the user enters a login name and associated password.  The user's account includes the selected picture for the Welcome screen and .NET passport.  Associated with the user's account is the user's profile.
administrator:  A special type of account that allows a user to make any changes or perform any actions (short of deleting the last remaining account).  As anything can be done under an administrator account (including the accidental installation of viruses and spyware), the use of administrator accounts should be restricted to special tasks such as creating, modifying, and deleting accounts, installing new software and hardware, and installing updates for Windows XP and other software.
Fast User Switching (FUS):  A new account login feature introduced with Windows XP.  Fast User Switching allows one user to log onto Windows without the current user needing to log off.  When another user uses FUS, the current user's session is suspended (i.e. any running programs continue running in the background and open files remain open).  FUS is only available to accounts that are not part of a network domain.  FUS requires that the Welcome screen is enabled and offline files are disabled.
FAT32:  A file storage technology first introduced with Windows 95 and carried over into Windows 98, Windows Me, Windows 2000 and Windows XP.  FAT32 provides virtually no means of restricting users' access to files and folders.  For example, any user of a Windows XP computer can view, modify, delete, or move files and folders on a FAT32 partition.  For better security, NTFS should be used instead.
guest:  A type of account with limited privileges like that of a limited user.  The chief difference between a guest and a limited user is that a guest cannot create a password for the account.  A guest account named “Guest” is automatically created when Windows XP is installed.  As a security measure, the Guest account is disabled by default.
limited user:  A type of account with limited privileges.  A limited user may modify her password, change her Welcome screen picture, set up a .NET passport, run certain programs, change the wallpaper and screensaver, and view shared files.  A limited user may not reset the clock, create or modify other users' accounts, delete other users' files and folders on an NTFS partition, or install certain software and hardware, or perform other actions that could harm other accounts or the Windows XP system as a whole.
network domain:  A networked set of computers, printers, and other hardware devices for the sharing of information and access to services such as e-mail and the Internet.  A user's access to the domain and its network resources (shared drives, printers, etc.) is controlled by a special computer called a domain controller.  Network domains are almost exclusively found in business environments where they are managed by network administrators.
.NET passport:  A .NET passport is a similar to an electronic wallet used for managing passwords for online services and managing payment information for online purchases.  Supported services include Microsoft Messenger and Hotmail.  A .NET passport may be managed by a user as part of her account.
network passwords:  Passwords used to access network resources and web sites.  Network passwords may be managed by a user as part of her account.
NTFS:  A file storage technology first introduced with Windows NT and later carried over into Windows 2000 and Windows XP.  NTFS provides support for setting rights to files and folders, thus enabling the administrator and users to restrict who may access which files and folders and what actions may be performed on them.
offline files:  When offline files are enabled, a user may work with files on another networked computer, even when the user is not logged onto the network.  Local copies of the files on the user's computer are synchronized with the remote copies whenever the user logs onto the network.  Offline files are only available in Windows XP Professional.  
Password Reset Disk:  A special recovery tool that a user can create for the event that she has forgotten her password to log onto Windows.  The Password Reset Disk may be created through the User Accounts applet in the Control Panel.  Look for and click on the link labeled “Prevent a Forgotten Password” and follow the instructions.  You will need a blank floppy disk, flash drive, or other removable media.  The disk need only be created once, even if the user subsequently sets or changes her password.  Note that it must be created before the need arises!
permission:  The ability to access a particular object in a defined manner, such as creating a folder on an NTFS partition and deleting jobs from a print queue.
privilege:  The ability to access objects or perform certain actions under Windows XP.  Both permissions and rights are types of privileges.
profile:  The user's personal, customized settings for Windows XP.  The profile consists of the user's files (My Documents), wallpaper and screensaver selections, desktop files and icons, customizations to the Start Menu and desktop toolbar, application settings, web browser bookmarks, and e-mail settings and messages.
right:  The ability to perform a particular action that affects the entire Windows system.  Rights include logging onto Windows and resetting the clock.
simple file sharing:  A feature of Windows XP that allows users to share files with one another.  Ordinarily, limited users cannot access one another's files on an NTFS partition.  By using simple file sharing, one user can make specific files of hers available for others to view.
Welcome screen:  The colorful graphical interface that allows users to log onto an account by clicking on the account's associated picture and then entering the account's passwords.  The pictures vary between such items as a chess piece, astronaut, space shuttle, dog, cat, parrot, and rubber ducky.

Tips and Warnings
Administrator accounts should only be used for special occasions such as installing software and hardware and managing accounts.  An administrator account should not be used for day-to-day activities such as reading e-mail and surfing the Internet.
Surfing the Internet can be especially hazardous as “drive-by downloads” may get into your computer.  A drive-by download can deposit malicious software such as spyware or a virus when the user visits a malicious website.  The download and installation occur without the user's knowledge.  If installed under a limited user's account, the malicious software can delete the user's files, collect sensitive data about their online transactions, and perform other malicious acts limited to the user.  On the other hand, if installed under an administrator account, the software can attack any user's files and wreck Windows XP.  Because of the danger of viruses, worms, and Trojan horses, administrators should also avoid reading e-mail and opening attachments.
Don't be an administrator.  By default, when you initialize Windows XP Home on a new computer, Windows will prompt you to create at least one or more accounts.  Windows will automatically make the new users administrators.  After the initialization, it is best to set up only one administrator account and create limited user accounts for yourself and everyone else who uses the computer.  Be aware that Windows XP Home also creates a default administrator account named “Owner.”  You may wish to rename it and set it up as the sole administrator.
Administrator accounts without passwords are very hazardous.  Without a password, anyone could log into Windows and make any changes he desires.  Always lock down administrator accounts with strong passwords.  Strong passwords consist of eight or more characters and (should ideally) consist of a random sequence of upper- and lower-case letters, numbers, and punctuation symbols.
Use an eye-catching wallpaper and color scheme for the administrator account.  This will serve as a reminder that you are logged in as an administrator, and you should thus be very careful about installing software or surfing the Internet.  Personally, I like to use the Microsoft's Red Desert wallpaper as the bright red stands as soon as I log in.
User accounts without passwords are dangerous.  If you do not set a password for your account, anyone could sit down and log on as you and access your files and sensitive data.  You should set a password, especially if you share the computer with other users, if your computer is at your workplace, or if your computer is a portable that you take with you.
Avoid user account names containing spaces as they can cause problems with some utilities such as command line tools for managing user accounts.
Superfluous administrator accounts can also be hazardous.  It is better to create a sole administrator account and make every other account a limited user.  (To “demote” a user from an administrator to a limited user, you must be logged on as an administrator.)  The fewer administrators there are, the less likely it is that a miscreant or mishap will harm your computer.
Some programs will not run for limited users, but there may be fixes or workarounds.  Try the following before logging on as an administrator:
•	If the program requires access to files or folders that do not belong to you, see whether they can be moved elsewhere.  As an example, Quicken 2000 Deluxe expects to find your financial files in the Quicken folder.  Try moving them to My Documents instead.  You may also try logging on as an administrator and then sharing the files and folders, although this is a less secure solution.
•	Any program may be run as another by using the “Run As” feature.  First right-click the program's shortcut and then left-click on “Run As” on the context menu.  You will be presented a dialog where you can enter the name of the administrator and the associated password.
Administrators can change other users' forgotten passwords, but be careful.  If an administrator changes another user's password, the user will lose access to encrypted files, stored passwords for web sites, and other data associated with the user's account.  It is better that each user creates their own Password Reset Disk and store it in a safe place in the event that they should forget their password. 
Since floppy disks have a tendency to fail without warning, each user should create a duplicate Password Reset Disk and test it periodically to be sure it still works.
When deleting a user's account, the administrator will be presented an option to save or delete the user's desktop files and My Documents folder.  If the files are saved, they will be placed in a subfolder under the administrator's My Documents folder.
Checking for new e-mail messages is easy to do when Fast User Switching is enabled.  When the user switches to the Welcome screen, the number of unread e-mail messages for each user is listed under their picture.