Post by D***@MadCow.net
- My Account which is says my user name and Administrator
- Guest Account.
The User Accounts app will not show hidden accounts. By default, the
Administrator account is hidden.
Since the Administrator account should ONLY be used in emergencies, tis
probably better to leave it hidden. Instead of using the cutsy
bobble-head logon screen that divulges half of the security of a login
(the username) and because I'd rather specify the account than pick one
in a list, I configured Windows to show the standard login screen. It
has one big security advantage over the bobble-head login screen: it
guarantees the login credentials were captured only by the OS because
that is the OS presenting the login window, not some malware pretending
to be a login screen (Windows intercepts the Ctrl+Alt+Del keyboard scan
code to ensure the login screen you see is the one from the OS). I
don't need the Administrator account listed in the bobble-heads login
window. I can simply enter "Administrator" as the account name in the
standard login screen (Loading Image...
"Users must enter a user name and password to use this computer":
(auto-login means anyone can physcially use your account on that
computer even with a locked screen saver - just reboot)
Secure login - Requires users to press Ctrl+Alt+Delete
Post by D***@MadCow.net
I use Macrium Reflect regularly to have recent backups of Windows and
all installed programs. Whenever I want to make some significant
change, I will make an image first. Then after the change seems to
work ok, I'll make another image. I keep a notebook log on all that
kind of stuff.
If UAC is enabled, you get a prompt to allow Macrium run with admin
privileges. Backup jobs scheduled in Macrium create Task Scheduler
events that run under the SYSTEM account.
Post by D***@MadCow.net
To avoid losing the only Administrator account, should I create
another Administrator account and not use it unless my account gets
Your normal logon is in the Administrators newsgroup. When you see your
Windows account with "Administrator" under in the User Accounts wizard,
that only means that Windows account was added to the Administrators
security group. Your account is likely also a member of the Home Users
security group. An account can be included in multiple security groups.
To see some more info about your account, run:
Alas, I have the Home edition which does not include the group policy
editor (gpedit.msc). That would let you see a list of the security
groups by their names. As I recall, it also listed the privileges of
You can use "net user" to get a list of Windows accounts (that you're
allowed to use). To get more info on your account, like to which
security groups your account is assigned, run:
net user <youraccount>
To see which account is attached to which security group, run "net
localgroup <securitygroup>". For example:
net localgroup (list all the user security groups)
net localgroup Administrators (all in the Administrator security group)
net localgroup homeusers (all in the Home Users security group)
Getting a list of what privileges (aka permissions) are specified in
which security group (SYSTEM, Administrators, Home Users, etc) is more
tricky requiring, for example, use of the icacls command. I only touch
that when I'm forced to so I'm not expert with it. That's why I miss
the gpedit.msc wizard in the Home edition. I'm not talking about folder
and file permissions (ACLs, or access control lists) in NTFS that you
can see in Windows Explorer by right-clicking a folder or file, pick
Properties from the context menu, and looking under the Security tab.
There are permissions in security groups (to which accounts are
assigned) that say what that account can do in the OS. File permissions
in NTFS is a separate security mechanism but can also be assigned by
account name or security group.
If you perform regularly scheduled backups (so they actually get done
instead of relying on you to do them), you don't need a backup
Administrator account. When you restore from an image backup, you'll
get back your user profile just like it was at backup time.
If you don't do backups then, yes, make sure the admin-level account you
use is one that was created for you, not the Administrator account.
Only use the Administrator account in emergencies. Awhile back, I also
created a duplicate of the Administrator account: create a new account
as an administrator (i.e., in the Administrators security group) named
something like AdminBackup, and never touch it unless somehow you screw
up the Administrators account which you shouldn't be using, anyway. To
make it a duplicate, you need 3 admin account: yours, Administrator, and
AdminBackup. You copy the Administrator profile atop of the AdminBackup
profile using your admin-level account (copying of user profiles
requires admin privs). In your admin-level account, run:
Go under the Advanced tab and click on Settings for User Profiles.
There you can copy Adminstrator's profile atop of AdminBackup's (or
whatever you called the backup admin emergency-only account). You
cannot be logged into the account whose profile you want to copy from or
copy into hence the need for the 3rd admin-level account to do the
profile copying. You could just leave AdminBackup with its own profile
which has nothing setup as in the Administrator profile. You just
create the AdminBackup account in the Administrators group. I usually
do some setup in Administrator that I also want in the backup
If you don't logon and use the Administrtator account as your daily
account then you probably don't need a backup Administrator account,
especially if you schedule regular image backups of the OS partition.
Obviously image backups are useless if saved on the save disk (even in
another partition) when the disk dies. You need to save image backups
somewhere else than the disk with the OS partition.
Post by D***@MadCow.net
Above, you said "I rely on backups to get me back to a prior working
state." Can you explain what backups you mean?
I do image backups of the partition(s) with the OS and apps. Partitions
with just data can be saved using image or logical (file level) backups.
With an image backup, a restore puts back the disk to the same state is
was during the backup. That is still a logical state so files may not
occupy the same sectors. The only way to get an exact state restore is
to perform a sector-by-sector copy but that wastes a lot of time if most
of the disk is empty (unused clusters in the file system).
System Restore might work but too often it fails. It is only a *system*
restore and somewhat flaky at that. It does not restore your apps or
your data. I turned it off because it is, to me, a waste of disk space.
Anyone doing image backups should kill System Restore; however, that
means you perform regularly scheduled image backup. Anytime the user is
left in charge of doing the backups means they won't get done except
once or twice and then forgotten. My image backups are scheduled to run
once per day. When I'm about to perform some major surgery on the OS
(e.g., Windows updates) or even before installing software (because
uninstallers are very often incomplete), I perform a manual image
backup. To dare a change means you should plan an escape route.