WIN: Windows Users and Groups

User Structure

Windows uses a user structure that categorizes users with different access rights. The two most common categories are Administrators and Standard Users.

Administrators

• Have full control over the computer.
• Can change system settings, install and uninstall programs, manage other user accounts, and perform many other tasks.
• Can modify sensitive system files and data.
• This role should only be assigned to trusted individuals.

Standard Users

• Have basic permissions to use the computer.
• Can run programs, open and edit files, and access the internet.
• Cannot change system settings, install or uninstall programs, or manage other user accounts.
• Limited permissions help maintain the computer's security and stability.

Other User Types

+---------------------------+
|       User Types          |
+---------------------------+
|  Administrator            |
|  - Full system control    |
|  - Install software       |
|  - Manage accounts        |
+---------------------------+
|  Standard User            |
|  - Run programs           |
|  - Open/edit files        |
|  - No system changes      |
+---------------------------+
|  Guest                    |
|  - Temporary, limited     |
+---------------------------+

Managing User Accounts

The quickest way to manage accounts is through Local Users and Groups.

Open the Start menu, type PowerShell, and open it. In the prompt, type:

lusrmgr.msc

In the window that appears, you can:

• Change account types
• Activate or deactivate accounts
• Reset passwords
• Manage group memberships

lusrmgr.msc
+-------------------------------+
|   Local Users and Groups      |
|                               |
|  [ Users ]                    |
|    - Administrator            |
|    - Guest                    |
|    - Your custom accounts     |
|                               |
|  [ Groups ]                   |
|    - Administrators           |
|    - Users                    |
|    - Guests                   |
|    - Remote Desktop Users     |
+-------------------------------+

User Account Control (UAC)

User Account Control (UAC) is a built-in security feature in Microsoft Windows. UAC works by asking for your confirmation before performing operations that require administrative permissions. This helps prevent errors caused by unauthorized changes or the installation of malicious software.

When a program attempts to perform an operation requiring administrative privileges (e.g., installing a program, changing system settings), the UAC prompt appears on screen. You need to approve or deny this action.

[ Application requests elevation ]
           |
           v
  [ UAC Prompt appears ]
  +------------------------------+
  | Do you want to allow this    |
  | app to make changes to your  |
  | device?                      |
  |                              |
  |  [ Yes ]       [ No ]        |
  +------------------------------+
           |
           v
  [ Elevated or denied ]

UAC Notification Levels

From highest to lowest security:

Advantages of UAC

• Security: Prevents unauthorized changes and installation of malicious software.
• Control: Provides more visibility over operations requiring administrative privileges.
• User-Friendly: Allows you to understand what is happening and stop an action before approving it.

Disadvantages of UAC

• Inconvenience: UAC may frequently request approval, which can be disruptive for power users.
• Incompatibility: Some older programs may not work correctly with UAC enabled.

Summary

Windows user account types — Administrator, Standard User, and Guest — define the level of access each user has on the system. Local accounts are managed via lusrmgr.msc. UAC adds a critical layer of security by requiring explicit approval before any privileged operation is performed, preventing both accidental changes and malicious software from silently modifying the system.