Limiting user rights on a system.
 

Hello All~

Long time no post! Here's the deal, which involves my little brother again... We bought him a new laptop for college. Of course - I am the one who got picked to get everything with it in working order.

I want to be able to restrict him from installing any application to to the laptop. I don't want to allow him any access to flash games or any poker games since that is all he does ever, and this laptop is not meant for him to play games - but to aid him in his college studies.

Currently, he is set up with admin rights since that is the account I installed everything under... I ended up setting myself up under the administrator account.

So the question is - how would I go about limiting his privileges to only using the computer and not install any applications and prevent him from playing any online games (typically the flash games - while allowing flash to be supported to load up for flash based websites - if possible) since any installable game would be prevented since it falls in with the category of installing programs?

Thanks in advance for all of your helpful tips! :D

[Edit] Forgot the most important part - he is running WindowsXP Pro with SP2...[/Edit]

Best,
-SlickVic78

He's going to college :confused:

... are you going to restrict the websites he visits too. :p

You really are looking out for your little brother. There are going to be apps that he might need to install for good reasons. Are you going to be around to be his 24/7 phone tech? If there is a special site he uses to play games, maybe you could just block that site or sites.

geez, Vic, he is going to college..he's not a "baby" anymore, so why are you trying to limit his permissions?
If he screws up, its part of "growing up" to solve your problems...

I say let him have full access, and warn him if he screws up, its HIS problem
!

Yeah I agree with you guys, but if mom asked.... :P

I would just give him a power account instead of admin or stupid user account.

I would then make him use FireFox and block all extensions, add-ons, etc. Use group policy. ;)

Guys guys guys - This wasn't my decision... I was given the order to do it... If it was my choice, I'd give him the warning and if he screwed up - then it is up to him to fix...

But - I already know where this is going simply because it happens a billion times a week where I have to fix something on his home PC... He has a habit of installing things he shouldn't and playing poker all day... Besides - he isn't paying for his college tuition - my parent's are - reason why I got the order to do what I have to do to prevent him from doing something stupid in the first place.

[Edit] Also, in response to KC - I wouldn't have to be around at all to deal with him if he needs an application to be installed... I can simply have my father install any applications he needs for school with no problems... [/Edit]

-SlickVic78

@Will, still running as Limited User since 1st of August. Personally I feel safer with LUA as Power User has write acccess to Windows and Program Files directories.

:( Personally I would NOT want to be in your shoes any worse than you probably do over this. Although one of the things that will have to be remembered is the fact that there will be plenty of other people there to help him undo what ever you do as far as setting up safe guards. So that leaves you with only a very few choices:

1: Set it as McoreD above said, which will be safer for him and the computer.
2: Teach him how to fix these things hisself because he will be using it along with
probably others also that he gets to know.
3: Then teach him the values of security.
4: Also don't forget to make a backup before he leaves and let him keep a "copy" with
him for the times when he will need it.
5: Let Mom and Dad know that ALL the safety you apply to the computer will do no
good when he gets at school where others can undo it rather quickly.
6: Teach him to backup his work.
7: Setup passwords where it will be the most use (firewalls, ip filters, etc, etc) :o

I said all that above because there is almost nothing impossible and there will come a time when you can not be there to fix it for him. Then you can tell him it is NOT your idea so if he screws it up his backside will be yours. :)

Good Luck

Thanks
Dudelive

Thanks for the pointers Dudelive. I guess that is all I can possibly do. I just know something is going to go wrong, and of course, I am going to have to be the one cleaning up the mess since it has always been this way - from spyware/adware, to virii - just can't win.

My parent's want him to take his education seriously since we noticed a decrease in his GPA in high school ever since someone introduced him to online poker. So they are wanting to do what they can to prevent him from using his new laptop for other means besides his education - believe me - I was on his side to install an IM client on his machine so he can chat with friends.

I've installed Adaware, SpywareBlaster, and Spybot on his machine to at least help protect his system from non-sense crap and installed a copy of Norton Antivirus on his machine. He knows the importance of security - but nothing will stop him from installing poker on that machine... He hasn't gotten his hands on the laptop yet for I am still working on it.

-SlickVic78

Faronics Corp. also have a couple of proggies out that might help you out a bit. And they are used in schools to protect their own computers. In particular Deep Freeze and Anti-Executable might be a couple of proggies you might want to look into. Good luck. ...griz ;)


http://www.faronics.com/html/AntiExec.asp
http://www.faronics.com/html/deepfreeze.asp

Give him a guest account on his pc and a Linux LiveCd to play around on the internet.....:D