The user account in Windows. User Account Control in Windows 7

Probably, today there is not a single person who does not face the situation when several people work on one computer, and everyone logs in using their login and password (the so-called user account in Windows). But not all users know what "accounting" is and how to change or control its main parameters.

What is a user account?

The term denoting an account is derived from the usual translation of the English phrase User Account. In other words, it is the identification of a user account by a computer system with different levels of access to information, parameters, personal settings, programs used, etc.

We do not need to explain that we are faced with accounts all over the place. Even the usual email address on the free mail server - and that can be treated as a "user account". The same goes for, for example, online games, users working on computer terminals connected to a local network, programs like Skype, ICQ, etc. In general, if one speaks in plain language, this is the user's registration data. But here all these types of "accountants" are quite different. Now we will consider the user accounts of Windows 10, as well as 8, 7 and other versions of the OS. Basically, their essence for all "operatsionok" remains the same.

What are the advantages of the user account?

So, first, let's see what are the advantages of the account. First of all, it should be noted that any user who does not have the right to access information at the administrator level can be completely confident in his own security - from the point of view that no other person equal to him in terms of access rights can view his personal Files, the history of working on the Internet, change personal data or do something else.

It turns out that the system simply hides all these files from prying eyes, but only if the folders and documents are not assigned the status of sharing, when such files can be used by absolutely all users of computers located, for example, in one local or virtual network . From the point of view of confidentiality, this is very good, and full access is available only from the administrator of a particular computer or the system administrator of the local network (sysadmin). Let's see what its functions are.

Administrator

As for the main (initially created) administrator account, it is possible to describe such "accounting" as granting the sole person full access rights to information, changing the configuration of system parameters, installing or removing programs and applications, and managing other accounts.

In simple terms, the administrator is the most important user, for whom there are no restrictions on working with the computer and the operating system, and which has exclusive privileges for performing certain actions. And it is the administrator who performs full control over user accounts with the ability to grant rights or limit the capabilities of any other user.

But the most interesting is that the computer system (if only one or several operating systems are installed) can have one or more administrators. It is better - if one. And of course, at the same time there can be users who have practically the same rights, but such a hierarchy can be compared, say, with the army.

Let's say there are two officers in the rank of colonel. But one of them is the commander of the regiment, and the second is the chief of staff. A title is an access right, a post is a user type. Probably, it is understandable that within the framework of one unit (the computer in our case) the regiment commander has the status of administrator, and the chief of staff (lower in position) is the user status with little restrictions in rights.

Types of users

Now let's go directly to the users and groups. Typically, all types of accounts in Windows are divided into three types: administrator, user with normal access (standard user account) and guest ("guest").

As already understood, the administrator has absolutely all the rights, ordinary users are allowed to simply work with a specific computer terminal. Guests are, roughly speaking, outsiders who have minimal rights (exclusively for logging on to the system, but no more).

As for groups, they can be created arbitrarily by the administrator himself, and in an unlimited number. In fact, it is possible to unify users using different rights and permissions in different groups, or group them by some other characteristic, for example, by belonging to a certain structure in the management of the enterprise (technical department, accounting, etc.).

User Account Control

Regarding control, the main functions are assigned to the administrator. The system in this case acts only as a means of enforcing the rights of users or maintaining a certain level of security.

In this case, it is worth noting that user account control (Windows 7, for example) can be performed only when logging in using the username and password. No other user has the right to make changes to the settings of "accountants", to grant rights to some actions or to remove restrictions.

It is especially worth noting one important point. Despite the fact that the system itself provides for the control of user accounts, Windows 7 and others, newer versions of the OS can provide temporary permissions to users (unless this is contrary to the security settings and Group Policy settings). To do this, the context menu for starting programs has a special startup line on behalf of the administrator. This approach allows users, for example, to install their own applications or use the same portable versions of programs that do not introduce critical changes to the system registry or do not change the security settings.

Access rights and restrictions imposed on accounts

As for restrictions on rights, they can be quite a lot. The fact is that the control of user accounts of the 8th, 7th or 10th version of Windows provides a fairly large range of what can be allowed or prohibited to the user with certain rights.

So, in most cases, the main restrictions for users below the level of the admin can be: to prohibit access to the registry and edit it, change the security settings or Group Policy settings.

At the same time, as a result, there is a ban on installing certain programs, using already installed applications or working with certain types of files and folders, reading removable media, etc. This is a reasonable step, since an inexperienced user can easily try to scan files on an infected Viruses a flash drive or install a suspicious program, and if the computer terminal is connected to a local network, the virus can easily migrate to other machines and harm so that absolutely all terminals will be a neup Capable.

That's why in the same "locks" often used quite interesting configuration of the system. In the standard version, each terminal installs its own "operating system" (no matter what modification it is), which operates independently of the central server.

In the second case, the operating system as such is not available on the computer at all (sometimes there is not even a hard disk), and the network OS downloads from a single terminal for all the remote servers. This type of boot can be seen in the BIOS settings (usually referred to as PXE Boot or Network Boot). The advantages of such a start of Windows are obvious, because a user, no matter how he wants to change any parameters, even the simplest ones, simply can not.

Creating an account in Windows

Now, for a while, let's leave the control of user accounts in check and consider how to create "accounting" of one type or another. As already mentioned above, after a clean installation of the system, the user obtains the rights of the administrator, and it is he who has the exclusive right to create, delete or change any account present in the system.

To create a new record on the local computer, in the simplest version, you need to enter the corresponding section of the Control Panel, then choose to create a new account, enter a name ("Petya", "Vasya" - not the essence) and determine the type of record Regular access or administrator), and then confirm your actions. After that, in the same section, you can create a login and password that will be used when logging in to the system. You can also change the picture and other parameters available for this account. And, naturally, the administrator's passwords and user accounts can change even without the intervention of the users themselves. In fact, in some cases (restriction of rights, for example) their consent is not required. But most often this applies to local networks and sysadmins, when the user in some way was guilty and caused damage to the system.

Manage personal account settings

In the management plan, the user account of any level is directly controlled by the administrator. However, the user can change some settings of the system, for example, the background image of the "Desktop", change the size of the windows, and so on.

As for the rights to change more serious parameters, they can be provided by the administrator through the control menu, in which the specified account is located. Another user can not change anything. Let's see what settings can be made in this case.

Change the basic settings for accounts

First of all, the administrator can configure the access rights to the system settings, programs and some types of files. All this is set either in the above section or in the Group Policy client.

However, you can first use the local users and groups section to add a user. To do this, enter the lusrmgr.msc command in the "Run" menu, and already in the computer management menu it is the users section where the right click brings up the menu with the possibility of adding a new person. You can add it to a group either through the properties menu, where group membership is selected, and then you enter the name of the workgroup and search for names, or by searching for groups yourself with the Advanced button. It remains only to confirm the choice.

If you talk about access rights to certain functions, it is best to use the control parameters in the Control Panel or in the system configuration (msconfig) with the choice of the service menu and control settings, but more on this later. In the Group Policy editor , you can also set the appropriate priorities (there are enough settings).

Deleting an account

You can delete or disable any "accounting" from the same "Control Panel", where you simply select the delete string in the management menu of another account (of course, when you log in as an administrator). That's all.

Then the user at a login attempt can then be notified that the user account is disabled. It will not be possible to restore it after uninstallation, so on behalf of the admin you will have to create a new one. However, when you delete a record, you can save the user files that will be available when the procedure is completed.

Disabling User Account Control through the "Control Panel"

If you talk about how to disable user account control, the first step is to use the "Control Panel".

Here you need to select the options menu, and in the window where the vertical slider is located, simply move the last one to the lowest position corresponding to the "Never notify" parameter, which means only that the system will not give out warnings of a passing change in the configuration.

Disabling User Account Control through the Command Line

As mentioned above, you can use the msconfig command in the "Run" menu to go to the "Tools" or "Tools" section, where you select the setting that corresponds to the control of user accounts.

Select this line, then click the "Start" button, and then perform the actions indicated just above. However, access to disconnection can be simplified if you immediately enter the line UserAccountControlSettings.exe as the command. Further all the same.

You can, of course, use the Registry Editor with the EnableLUA parameter change (changing the value to "0"), which is located in the Policies \ System branch of the main tree HKEY_LOCAL_MACHINE \ Software and further, or with the help of the Windows command processor (in both cases the user account Remains unchanged, and control over it will be disabled). However, these methods will be somewhat complicated for the ordinary user.

Instead of an afterword

Here in brief and all that concerns what is "accounting" and control of user accounts on the local computer. The topics related to similar actions of the administrator of the local network were not considered here, but, in principle, one could say that all the basic procedures are practically the same, except that sometimes some changes and settings can affect the internetworking protocols. But this, as they say, is another matter.