Microsoft introduced multi-user capability to Windows with NT but few people appear to take advantage of this feature. Part of the reason is security: you need to be sure that whoever you share the computer with can't access, delete or alter your data, or system software.
Luckily, Windows XP Professional comes with a number of improvements and features for safe sharing. (Note: all the tasks covered here require the system disk to be formatted with NTFS, and for you to be logged on as Administrator.)Wise administrationFirst, you need to make sure that no software is installed without your knowledge. Rule number one: only run Windows XP under the Administrator account when you need to change system settings. If you forget to log out, anyone can have complete access to the entire system.
Malicious scripts on Web pages can also install and run software that affects the entire system. Note that you don't need to log out as a normal user, and log in as Administrator, in order to perform most system administration tasks - Windows XP will ask for the Administrator password in these situations.
Create user accounts for you and any user to whom you want to give access on the machine in question. All users should have passwords that aren't obvious, and use
to log onto the machine.
The Add New User wizard offers three user types for this: Standard, Restricted and Other. Be careful here: the Standard user is actually a member of the Power Users group, which can shut down the computer, change the system time, and install some software, certified by the Administrator.
This might be too liberal in some situations (conversely, the Restricted user might be too limited). You may also want to tweak the default settings for the new users (for example, change the look of the menu, or what theme to load).
Adjusting settings is easy with the Group Policy Editor. To start it up, click Start-Run and type gpedit.msc in the dialogue box.
GPEDIT is divided into two main areas: Computer Configuration and User Configuration. However, confusingly, you edit some user settings under the former, and some system settings under the latter. For instance, to check and possibly change the rights of the Power Users group on your machine, drill down to Computer Configuration-Windows Settings-Security Settings-Local Policies-User Rights Management. Here, you can see how the different groups of users can interact with Windows XP, and alter their rights if so needed.
Similarly, go to User Configuration to change and lock down Windows XP's default behaviour, and take a look. Don't want users to change your strict Internet Web browsing security settings? Administrative Templates-Windows Components-Internet Control Panel-Disable the Security Page takes care of that.
Want to stop the Windows Messenger from loading for your users? Go to Computer Configuration-Administrative Templates-Windows Components-Windows Messenger, and enable both Do Not Allow Windows Messenger To Run and Do Not Automatically Run Windows Messenger Initially.
In fact, by going to User Configuration-Administrative Templates-System, you can create a tightly locked-down Windows XP interface, deciding exactly which applications to run and which to keep off-limits for users. Some settings (like Logon/Logoff Scripts) are found under both Computer and User Configuration; the settings under the former take precedence over the ones under the latter.
With judicious pointing and clicking, GPEDIT allows you to prevent common user mistakes like deleting important files and folders, as well as to tweak the user interface to suit your users. It will even help you prevent access to removable drives, and to turn off, for example, CD burning - a good idea if you would like to prevent unauthorised copying of data.
Note that GPEDIT has three settings: Not Configured, Disabled and Enabled, which is a bit confusing. Make sure you run GPEDIT in the Extended interface mode (click on the tab in the right-hand pane); doing so displays context-sensitive help text to the left of the items that you are editing, including definitions of what the settings actually do (see FIGURE 1). Enabling a setting can sometimes do the opposite of what you think, and actually disable a system feature.
GPEDIT is a very powerful tool, so explore it with caution. Don't change settings if you don't understand their meaning; you could lock yourself out of the computer. And remember to back up everything before making changes.