Granting user access

[DJBeanPole17]

Ok I tried fooling around with this shiz last night but I got confused and realized I need some help. My dad's computer is a POS and my mom was getting frustrated with it so I said just use mine so I made an account for her (a limited account on Windows XP Pro). Using that computer management thing, she's listed under 'Users'. I myself am listed as 'Administrators' and 'Power Users'. I disabled simple file sharing to change access to folders. How do I make it so that some folders can't be accessed by my mom but are still ok for me to look at (she can't open them logged onto her acct, but I can logged onto mine). I tried making it so that anyone under 'Users' couldn't access certain folders but I discovered after doing that I couldn't either so I changed it back. What am I missing? What exactly do I do? Why are there so many damn groups listed for the file permissions stuff!!! Like: Administrators, CREATOR OWNER, David (my acct), SYSTEM, Users!!! They all have different persmissions and I dunno what the hell I'm so confused lol. help me!

[SkyDog]

To give yourself something to practice with, create a new folder. Then right-click that folder and click Properties.

On the Security tab, change the permissions so that the Administrators group is the only entry. And when Administrators is highlighted, the "Full Control" box below should be checked. Click OK.

Now anyone whose account is a member of the Administrators group will have access to that folder, while users that aren't in the Administrators group won't. That's all there is to it. For what you're looking to do, you don't need to mess with any of the other groups or permission settings.

------------

A couple random thoughts to add:

If your account is in the Administrators group, it doesn't need to be in the Power Users group, too. Administrators have all the rights that Power Users do, so it's redundant to be in both.

Except in very rare circumstances, you don't need to use the "Deny" setting. It's only there for the occasion that you want to grant an entire group permission to something except one or two people. For example, let's say you work for a company and need to grant permission to all 10 accountants except Dave. Instead of granting permission separately to each of the other 9 accountants, you would create a group named Accountants, give that group permission, and then Deny permission to Dave. That way, you only needed to set two permissions instead of nine.

[DJBeanPole17]

Thanks SkyDog! How would I do things though like, not allowing anyone to delete files, like... opening add/remove software and deleting my stuff? I know there are programs that can hide it, but the one I did have hid it from me as well and I didn't like that. Any help?

Thanks dog lol,

Dave

[muisejt]

users in the USERS group cannot add/remove software, or change many settings.

Best thing for you to do is login as a user in the USERS group try to do things and if that user can still do things you don't want them to do you could use policies to stop it

[DJBeanPole17]

Thanks muisejt. I tried that earlier and logged into the account I set up for her and I was still able to access (thru control panel) the add/remove software and it looked like I was able to delete things... coz it asked me "are you sure you wish to delete" etc or whatever it says. I didn't do it though because, well, obviously I don't want my stuff deleted. I'll look into the policies thing.

Thanks,

Dave

[SkyDog]

If I remember correctly, I'm pretty sure the Users group doesn't have permission to add or remove programs. You may get the "Are you sure?" dialog box, but if you clicked Yes, it would probably block you. If you want a little more information on what Users, Power Users, and Administrators are allowed to do by default, take a look at THIS PAGE on Microsoft's web site.

As for what users can see or can't see, there are a few things you can do. If you're talking about the contents of a folder, then a user won't be able to see anything in a folder if they don't have NTFS permissions to the folder. There's a permission labeled "list contents", and if they're not granted that permission, they can see the folder itself, but not what's in it.

As for various options, menus, control panels, and whatnot, a lot of that can be controlled via Group Policy. But when you use Group Policy on a single computer instead of a domain, ALL users on that computer get the policy. What you would have to do instead is edit users' profiles directly (or the "Default User" profile). This probably isn't necessary in your case, though. Just by making sure people are in the Users group and not Power Users or Administrators, there's a lot of stuff they can see, but aren't allowed to change.