Local users and groups

  • Best Practices
  • How to
  • Concepts
  • Troubleshooting


Best practices

  • Do not log on with administrative rights. Log on as a normal user and use the runas command when performing administrative tasks.

    • Using the runas command, you can run administrative tools with administrative rights and permissions while logged on as a user. You can also create shortcuts to run tools with administrative rights.

    For more information, click:

    • Why you should not run your computer as an administrator
    • Start a program as an administrator
    • Create a shortcut using the runas command

    For details about the runas command, see Runas.

  • Limit the number of users in the Administrators group.

    • Members of the Administrators group have Full Control permissions, so you will want to limit the number of users in that group. Add a user to the Administrators group if the user will perform only administrative tasks.

    For more information, click Why you should not run your computer as an administrator.

  • Use passwords no longer than 14 characters if you are on a network with computers running Windows 95 and Windows 98.

    • You can create a password containing up to 127 characters. However, computers running Windows 95 and Windows 98 support passwords up to only 14 characters. If your password is longer, you may not be able to log on to your network from those computers.

    For more information, see:

    • Create a new user account
    • Creating strong passwords


How to...

  • Create and modify local user accounts
  • Create and modify user profiles
  • Create, add, and delete local groups


Create and modify local user accounts

  • Create a new user account
  • Modify a user account
  • Change the password for a user
  • Disable or activate a user account
  • Identify members of local groups
  • Delete a user account
  • Rename a user account


Create a new user account

Microsoft Windows graphic

To create a new user account

  1. Open Computer Management.
  2. In the console tree, click Users.

    Where?

    • Computer Management
    • System Tools
    • Local Users and Groups
    • Users
  3. On the Action menu, click New User.
  4. Type the appropriate information in the dialog box.
  5. Select or clear the check boxes for:
    • User must change password at next logon
    • User cannot change password
    • Password never expires
    • Account is disabled
  6. Click Create, and then click Close.

Notes

  • XOX
  • A user name cannot be identical to any other user or group name on the computer being administered. It can contain up to 20 uppercase or lowercase characters except for the following:

    • " / \ [ ] : ; | = , + * ? < >

    A user name cannot consist solely of periods (.) or spaces.

  • In Password and Confirm password, you can type a password containing up to 127 characters. However, if you're using Windows 2000 or XOX on a network that also has computers using Windows 95 or Windows 98, consider using passwords not longer than 14 characters. Windows 95 and Windows 98 support passwords of up to 14 characters. If your password is longer, you may not be able to log on to your network from those computers.
  • You should not add a new user to the Administrators group unless the user will perform only administrative tasks. XOX

Related Topics


Modify a user account

To modify a user account

  1. Open Computer Management.
  2. In the console tree, click Users.

    Where?

    • Computer Management
    • System Tools
    • Local Users and Groups
    • Users
  3. Right-click the user account you want to modify, and then click Properties.
  4. Make the changes you want, and then click OK.

Note

  • XOX


Change the password for a user

To change the password for a user

  1. Open Computer Management.
  2. In the console tree, click Users.

    Where?

    • Computer Management
    • System Tools
    • Local Users and Groups
    • Users
  3. Right-click the user account you want to change, and then click Set Password.

Notes

  • XOX
  • Strong passwords improve computer and network security. XOX


Disable or activate a user account

To disable or activate a user account

XOX

  1. Open Computer Management.
  2. In the console tree, click Users.

    Where?

    • Computer Management
    • System Tools
    • Local Users and Groups
    • Users
  3. Right-click the user account you want to change, and then click Properties.
  4. Do one of the following:
    • To disable the selected user account, select the Account is disabled check box.
    • To activate the selected user account, clear the Account is disabled check box.

Notes

  • XOX
  • A disabled account still exists, but the user is not permitted to log on. It appears in the details pane, but the icon has an X in it.
  • When a user account is activated, the user is permitted to log on normally.
  • The built-in Administrator account cannot be disabled.


Identify members of local groups

To identify members of local groups

XOX

  1. Open a Command Prompt window.
  2. Do one or more of the following:
    • To list members of the Power Users group, type:

      • net localgroup "power users"

      You must include the quotation marks.

    • To list members of the Users group, type:

      • net localgroup users

    • To list members of the Administrators group, type:

      • net localgroup administrators

Notes

  • XOX
  • For more information about the net localgroup command, click Related Topics.


Delete a user account

To delete a user account

  1. Open Computer Management.
  2. In the console tree, click Users.

    Where?

    • Computer Management
    • System Tools
    • Local Users and Groups
    • Users
  3. Right-click the user account you want to delete, and then click Delete.

Notes

  • XOX
  • When you need to remove user accounts, it is a good idea to disable the accounts first. When you are certain that disabling the account has not caused a problem, you can safely delete it.
  • A deleted user account cannot be recovered.
  • The built-in Administrator and Guest accounts cannot be deleted.


Rename a user account

To rename a user account

  1. Open Computer Management.
  2. In the console tree, click Users.

    Where?

    • Computer Management
    • System Tools
    • Local Users and Groups
    • Users
  3. Right-click the user account you want to rename, and then click Rename.
  4. Type the new user name, and then press ENTER.

Notes

  • XOX
  • Because it retains its security identifier (SID), a renamed user account retains all its other properties, such as its description, password, group memberships, user environment profile, account information, and any assigned permissions and rights.
  • A user name cannot be identical to any other user or group name of the computer being administered. It can contain up to 20 uppercase or lowercase characters except the following:

    • " / \ [ ] : ; | = , + * ? < >

    A user name cannot consist solely of periods (.) or spaces.


Create and modify user profiles

  • Create a roaming or mandatory profile
  • Assign a mandatory user profile
  • Assign a logon script to a profile
  • Specify a home folder for a profile


Create a roaming or mandatory profile

To create a roaming or mandatory profile

  1. Open Computer Management.
  2. In the console tree, click Users.

    Where?

    • Computer Management
    • System Tools
    • Local Users and Groups
    • Users
  3. Right-click the user account you want, and then click Properties.
  4. On the Profile tab, in Profile path, type the path to the share where the profile will be saved.

    5. For a network path, use the following form:

    \\ServerName\ProfilesFolderName\UserProfileName

    For example:

    \\Puma\Profiles\Clerk

Notes

  • XOX
  • To create a roaming or mandatory user profile, use Shared Folders in Computer Management to create a share on the appropriate server. Then, grant Full Control to the Everyone group, and type the full path in Profile path, such as:

    • \\Airedale\Profiles\Amyand

  • If users will not log on to computers running Windows NT 3.x, then the user profile path does not need a file name. If users will log on to computers running Windows NT 3.x as well as to computers running Windows NT 4.0, Windows 2000, or XOX, then the user profile path must contain a file name. The file name can be that of a roaming user profile (.usr) or a mandatory user profile (.man), such as:

    • \\Airedale\Profiles\Clerks.man

  • If users will log on only to computers running Windows 2000 or XOX, the user profile path should be to a folder name and should not include an extension of .usr or .man. If the folder specified in the user profile path does not exist, it is automatically created the first time the user logs on.
  • To assign the same preconfigured roaming user profile to multiple user accounts, first enter the user profile path separately for each user account specified in step 4. Then, you must copy a preconfigured user profile to the location that you specify in step 4. XOX Click the profile you want to copy, and then click Copy To.
  • When administering multiple user accounts, do not assign one preconfigured roaming user profile to multiple accounts unless it is a mandatory user profile.


Assign a mandatory user profile

To assign a mandatory user profile

XOX

  1. Open Computer Management.
  2. In the console tree, click Users.

    Where?

    • Computer Management
    • System Tools
    • Local Users and Groups
    • Users
  3. Right-click the user account you want, and then click Properties.
  4. On the Profile tab, in Profile path, type the location of the profile you want to assign.

    5. For a network path, use the following form:

    \\ServerName\ProfilesFolderName\UserProfileName

    For example:

    \\Puma\Profiles\Clerk

Notes

  • XOX
  • To assign a mandatory user profile, you must properly configure the network folder that you specify in step 4. In Computer Management, use Shared Folders to create a shared folder on the appropriate server, and then grant Full Control to the Everyone group.
  • To assign a mandatory user profile, you must also copy a preconfigured user profile to the location that you specify in step 4. XOX Click the profile you want to copy, and then click Copy To. In Copy profile to, type the path for the folder that you have specified in step 4 and rename NTUser.dat to NTUser.man.
  • If users will not log on to computers running Windows NT 3.x, then the user profile path does not need a file name. If users will log on to computers running Windows NT 3.x as well as to computers running Windows NT 4.0, Windows 2000, or XOX, then the user profile path must contain a file name. The file name can be that of a roaming user profile (.usr) or a mandatory user profile (.man), such as:

    • \\Airedale\Profiles\Clerks.man

  • If users will log on only to computers running Windows 2000 or XOX, the user profile path should be to a folder name and should not include an extension of .usr or .man. If the folder specified in the user profile path does not exist, it is automatically created the first time the user logs on.


Assign a logon script to a profile

To assign a logon script to a profile

  1. Open Computer Management.
  2. In the console tree, click Users.

    Where?

    • Computer Management
    • System Tools
    • Local Users and Groups
    • Users
  3. Right-click the user account you want, and then click Properties.
  4. On the Profile tab, in Logon script, type the file name and location of the script.

    5. For a network path, use the following form:

    \\ServerName\ProfilesFolderName\UserProfileName

    For example:

    \\Puma\Profiles\Clerk

Notes

  • XOX
  • If the logon script is stored in a subdirectory of the domain controller's logon script path (Sysvol\DomainName\Scripts), precede the file name with that relative path, such as:

    • clerks.bat or admins\lauraj.cmd


Specify a home directory for a profile

To specify a home directory for a profile

  1. Open Computer Management.
  2. In the console tree, click Users.

    Where?

    • Computer Management
    • System Tools
    • Local Users and Groups
    • Users
  3. Right-click the user account for which you want to specify a home folder, and then click Properties.
  4. On the Profile tab, click Connect, and then specify a drive letter.
  5. In To, type a path.
    • You can use a network path, such as:

      • \\airedale\users\philsp

    • Or a local path, such as:

      • c:\users\kimy

    • You can substitute %username% for the last subdirectory in the path, such as:

      • \\airedale\users\%username%

Notes

  • XOX
  • My Documents offers a convenient alternative to home directories, but does not replace them. Each user has a My Documents folder on the boot volume. XOX
  • XOX
  • You can use Group Policy to change the target folder location of any user's My Documents folder. You can also disable a user's ability to change the target folder location, add or remove the My Documents icon from the desktop, or choose whether programs use My Documents or a different folder as the default location for opening and saving files.
  • If no home folder is assigned here, the system assigns the default local home folder to the user account (\Users\Default on the user's local drive where the operating system files are installed as an upgrade, or the root directory where the operating system files are installed as the initial version).
  • To specify a network path for the home folder, you must first create the network share and set permissions that allow the user access. You can do this with Shared Folders in Computer Management on the other computer.
  • For more information about home folders and My Documents, click Related Topics.


Create, add, and delete local groups

  • Create a new local group
  • Add a user to a group
  • Delete a local group


Create a new local group

To create a new local group

  1. Open Computer Management.
  2. In the console tree, click Groups.

    Where?

    • Computer Management
    • System Tools
    • Local Users and Groups
    • Groups
  3. Click Action, and then click New Group.
  4. In Group name, type a name for the new group.
  5. In Description, type a description of the new group.
  6. Click Create, and then click Close.

Notes

  • XOX
  • To add one or more users to a new group, after step 5, click Add.
  • A local group name cannot be identical to any other group or user name on the computer being administered. It can contain up to 256 uppercase or lowercase characters except for the following:

    • " / \ [ ] : ; | = , + * ? < >

    A group name cannot consist solely of periods (.) or spaces.


Add a user to a group

To add a member to a group

  1. Open Computer Management.
  2. In the console tree, click Groups.

    Where?

    • Computer Management
    • System Tools
    • Local Users and Groups
    • Groups
  3. Right-click the group in which you want to add a member, point to All Tasks, click Add to Group, and then click Add.
  4. Click Look in to display a list of domains from which users and groups can be added to the group.
  5. In Location, click the domain containing the users and computers you want to add, and then click OK.
  6. In Name, type the name of the user or group you want to add to the group, and then click OK.

    7. If you want to validate the user or group names that you are adding, click Check Names.

Notes

  • XOX
  • To remove a member from a local group, select the user or group in Members, and then click Remove.
  • A user who belongs to a group has all the rights and permissions granted to that group. If a user is a member of more than one group, then the user has all the rights and permissions granted to every group he or she belongs to. XOX
  • You should not add a new user to the Administrators group unless the user will perform only administrative tasks. XOX
  • You can add user accounts from the local computer. If the computer participates in a domain, you can add user accounts and global groups from that domain and from trusted domains.


Delete a local group

To delete a local group

  1. Open Computer Management.
  2. In the console tree, click Groups.

    Where?

    • Computer Management
    • System Tools
    • Local Users and Groups
    • Groups
  3. Right-click the group you want to delete, and then click Delete.

Notes

  • XOX
  • The following built-in groups cannot be deleted:
    • Administrators
    • Backup Operators
    • Power Users
    • Users
    • Guests
    • Replicator
  • A deleted group cannot be recovered.
  • Deleting a local group removes only the group; it does not delete the user accounts and global groups that were members of that group.
  • If you delete a group and then create another group with the same group name, you must set new permissions for the new group; it will not inherit the permissions that were granted to the old group.


Concepts

  • Overviews
  • Administering users and groups


Overviews

  • Local Users and Groups overview
  • Users overview
  • Groups overview


Local Users and Groups overview

Local Users and Groups is a tool you can use to manage local users and groups. It is available on the following operating systems:

  • Windows 2000 Professional
  • XOX
  • Member servers running Windows 2000 Server

A local user or group is an account that can be granted permissions and rights from your computer. Domain or global users and groups are managed by your network administrator. You can add local users, global users, and global groups to local groups. However, you cannot add local users and groups to global groups.

Local Users and Groups is an important security feature because you can limit the ability of users and groups to perform certain actions by assigning them rights and permissions. A right authorizes a user to perform certain actions on a computer, such as backing up files and folders or shutting down a computer. A permission is a rule associated with an object (usually a file, folder, or printer) and it regulates which users can have access to the object and in what manner.

Local Users and Groups is not available on domain controllers. Use Active Directory Users and Computers to manage global users and groups.

For more information, see:

  • Working with MMC console files
  • Groups overview
  • Users overview
  • Create a new user account
  • Create a new local group
  • Default security settings


Users overview

Users displays the two built-in user accounts, Administrator and Guest, as well as any user accounts you create. The built-in user accounts are created automatically when you install Windows 2000 or XOX.

Administrator account

The Administrator account is the one you use when you first set up a workstation or member server. You use this account before you create an account for yourself. The Administrator account is a member of the Administrators group on the workstation or member server.

The Administrator account can never be deleted, disabled, or removed from the Administrators local group, ensuring that you never lock yourself out of the computer by deleting or disabling all the administrative accounts. This feature sets the Administrator account apart from other members of the Administrators local group.

Guest account

The Guest account is used by people who do not have an actual account on the computer. A user whose account is disabled (but not deleted) can also use the Guest account. The Guest account does not require a password. The Guest account is disabled by default, but you can enable it.

You can set rights and permissions for the Guest account just like any user account. By default, the Guest account is a member of the built-in Guests group, which allows a user to log on to a workstation or member server. Additional rights, as well as any permissions, must be granted to the Guests group by a member of the Administrators group.


Groups overview

Groups displays all built-in groups as well as groups you create. The built-in groups are created automatically when you install Windows 2000 or XOX. Belonging to a group gives a user rights and abilities to perform various tasks on the computer.

Administrators

Members of the Administrators group have the largest amount of default permissions and the ability to change their own permissions.

Backup Operators

Members of the Backup Operators group can back up and restore files on the computer, regardless of any permissions that protect those files. They can also log on to and shut down the computer, but they cannot change security settings.

Power Users

Members of the Power Users group can create user accounts, but can modify and delete only those accounts they create. They can create local groups and remove users from local groups they have created. They can also remove users from the Power Users, Users, and Guests groups.

They cannot modify the Administrators or Backup Operators groups, nor can they take ownership of files, back up or restore directories, load or unload device drivers, or manage the security and auditing logs.

Users

Members of the Users group can perform most common tasks, such as running applications, using local and network printers, and shutting down and locking the workstation. Users can create local groups, but can modify only the local groups that they created. Users cannot share directories or create local printers.

Guests

The Guests group allows occasional or one-time users to log on to a workstation's built-in Guest account and be granted limited abilities. Members of the Guests group can also shut down the system on a workstation.

Replicator

The Replicator group supports directory replication functions. The only member of the Replicator group should be a domain user account used to log on the Replicator services of the domain controller. Do not add the user accounts of actual users to this group.


Administering users and groups

  • Why you should not run your computer as an administrator
  • Default security settings
  • Home folders and My Documents


Why you should not run your computer as an administrator

Running Windows 2000 or XOX as an administrator makes the system vulnerable to Trojan horses and other security risks. The simple act of visiting an Internet site can be extremely damaging to the system. An unfamiliar Internet site may have Trojan horse code that can be downloaded to the system and executed. If you are logged on with administrator privileges, a Trojan horse could do things like reformat your hard drive, delete all your files, create a new user account with administrative access, and so on.

You should add yourself to the Users or Power Users group. When you log on as a member of the Users group, you can perform routine tasks, including running programs and visiting Internet sites, without exposing your computer to unnecessary risk. As a member of the Power Users group, you can perform routine tasks and you can also install programs, add printers, and use most Control Panel items. If you need to perform administrative tasks, such as upgrading the operating system or configuring system parameters, then log off and log back on as an administrator.

If you frequently need to log on as an administrator, you can use the runas command to start programs as an administrator. For more information, see To start programs as an administrator.


Home folders and My Documents

Home folders and My Documents make it easier for an administrator to back up user files and manage user accounts by collecting many or all of a user's files in one location.

In Windows NT 4.0 and 3.x, an assigned home folder became a user's default folder for the Open and Save As dialog boxes, for command prompt sessions, and for all programs without a defined working folder. An assigned home folder could be a local folder on a user's computer or a shared folder on the network, and could be assigned to a single user or many users.

In Windows 2000 and XOX, the My Documents folder is an alternative for home folders but does not replace them. When a user tries to save or open a file, most programs determine whether to use the home folder or My Documents in one of two ways:

  • Some programs first look in the home folder for files that match the type of file that is to be opened or saved (for example, *.doc or *.txt). If a file with that extension is found, the program opens the home folder and ignores My Documents. If a file of that type is not found, the program opens My Documents.
  • In other programs, the home folder is ignored, regardless of whether the home folder contains any files.

When Windows 2000 or XOX is installed over a version of Windows NT, programs that have stored documents in the home folder will continue to open and save documents in the home folder. However, if the program is installed after Windows 2000 or XOX was installed, or if the program was never used to create a file in Windows NT, the program uses My Documents to open and save files.


Managing groups from the command line

The following command-line tool can be used to manage groups.

Name | Description
Net localgroup | This command adds, displays, or modifies local groups.

Additional command-line tools are available in the Support tools folder of the product compact disc and from the Resource Kit.

For information about other command-line utilities, see Command-line reference.


Local Users and Groups Troubleshooting

Troubleshooting

What problem are you having?

Runas command failed.

Cause: The Secondary Logon service is not running.

Solution: Start the Secondary Logon service.

Cause: The Secondary Logon service is running; however, you do not have permissions on the network share that is running the Secondary Logon service.

Solution: Verify that your local account in Computer Management has the permissions needed to access the network share on which the Secondary Logon service is installed. To view permissions in Computer Management, in Control Panel, double-click Administrative Tools, and then double-click Computer Management.

See also Runas

Cannot log on to a network computer running Windows 95 or Windows 98.

Cause: Your password is longer than 14 characters.

Solution: Create a new user account or change your password to the 14 character maximum for Windows 95 and Windows 98.

See also: To change the password for a user

Cannot assign a mandatory user profile.

Cause: The preconfigured user profile is not located on the specified network and needs a different file extension.

Solution: Copy the user profile to the specified network location and change the file extension. In Control Panel, double-click System, click the Advanced tab, under User Profiles, click Settings. Then, click the profile you want to copy and click Copy To. In Copy profile to, type the path to the folder that you have created and rename NTUser.dat to NTUser.man.

See also: To assign a mandatory user profile


Use the runas command to start programs as an administrator

  • Create a shortcut using the runas command
  • Start a program as an administrator


Start a program as an administrator

To start a program as an administrator

  1. In Windows Explorer, click the program executable file that you want to open.
  2. Press SHIFT and hold, right-click the program icon, and then click Run as.
  3. To log on using an Administrator account, click The following user.
  4. In User name and Password, type the Administrator account name and password that you want to use.

Notes

  • Use this procedure if you want to perform administrative tasks when you are logged on as a member of another group, such as Users or Power Users.
  • If you want to run a program as a domain administrator, in User name, type the name of the domain followed by the administrator account name. For example:

    • DomainName\AdministratorName

  • Use of Run as is not limited to Administrator accounts.
  • If you try to start a program, such as an MMC console or Control Panel item, from a network location using Run as, it could fail if the credentials used to connect to the network share are different from the credentials used to start the program. The credentials used to run the program might not be able to gain access to the same network share.
  • If Run as fails, the Secondary Logon service may not be running. XOX
  • You can also use Run as from the command prompt. XOX
  • The Secondary Logon service accepts only password authentication. If policies require smart card logon, then Run as will not work.


Create a shortcut using runas command parameters

To create a shortcut using the runas command

  1. Right-click the desktop, point to New, and then click Shortcut.
  2. In Type the location of the item, type runas and the command parameters you want to use. See examples in the following table.
    3. To create a shortcut to | Type | Description
A command prompt with administrator credentials | runas /user:ComputerName\administrator cmd | The title bar of this window will indicate the credentials under which it is running.
Computer Management with administrator credentials | runas /user:ComputerName\administrator "mmc %windir%\system32\compmgmt.msc" | The Computer Management window provides no indication of the credentials under which it is running. This could cause confusion if you start two or more Computer Management windows in different security contexts.
Active Directory Users and Computers with domain administrator credentials (Windows 2000 Server only) | runas /user:DomainName\administrator "mmc %windir%\system32\dsa.msc" | The Active Directory Users and Computers window provides no indication of the credentials under which it is running. This could cause confusion if you start two or more Active Directory Users and Computers windows in different security contexts.
Active Directory Users and Computers in another forest (Windows 2000 Server only) | runas /netonly /user:DomainName\UserName "mmc.exe dsa.msc" | The Active Directory Users and Computers window provides no indication of the credentials under which it is running. This could cause confusion if you start two or more Active Directory Users and Computers windows in different security contexts.
  3. Click Next, type a name for the shortcut, and then click Finish.

Notes

  • The shortcut will run with the permissions granted to that user. If the user account is an Administrator or a member of the Administrators group, you can perform administrative tasks.
  • Use of the runas command is not limited to Administrator accounts.
  • If the runas command fails, the Secondary Logon service may not be running.
  • For more information about the runas command, click Related Topics.