XP PRO: Safe sharing

Microsoft introduced multi-user capability to Windows with NT but few people appear to take advantage of this feature. Part of the reason is security: you need to be sure that whoever you share the computer with can't access, delete or alter your data, or system software.

Luckily, Windows XP Professional comes with a number of improvements and features for safe sharing. (Note: all the tasks covered here require the system disk to be formatted with NTFS, and for you to be logged on as Administrator.)Wise administrationFirst, you need to make sure that no software is installed without your knowl­edge. Rule number one: only run Windows XP under the Administrator account when you need to change system settings. If you forget to log out, anyone can have complete access to the entire system.

Malicious scripts on Web pages can also install and run software that affects the entire system. Note that you don't need to log out as a normal user, and log in as Administrator, in order to perform most system administration tasks - Windows XP will ask for the Administrator password in these situations.

Create user accounts for you and any user to whom you want to give access on the machine in question. All users should have passwords that aren't obvious, and use -- to log onto the machine.

The Add New User wizard offers three user types for this: Standard, Restricted and Other. Be careful here: the Standard user is actually a member of the Power Users group, which can shut down the computer, change the system time, and install some software, certified by the Administrator.

This might be too liberal in some situations (conversely, the Restricted user might be too limited). You may also want to tweak the default settings for the new users (for example, change the look of the menu, or what theme to load).


Adjusting settings is easy with the Group Policy Editor. To start it up, click Start-Run and type gpedit.msc in the dialogue box.

GPEDIT is divided into two main areas: Computer Configuration and User Configuration. However, confusingly, you edit some user settings under the former, and some system settings under the latter. For instance, to check and possibly change the rights of the Power Users group on your machine, drill down to Computer Con­figuration-Windows Settings-Security Settings-Local Policies-User Rights Management. Here, you can see how the different groups of users can interact with Windows XP, and alter their rights if so needed.

Similarly, go to User Configuration to change and lock down Windows XP's default behaviour, and take a look. Don't want users to change your strict Internet Web browsing security settings? Administrative Templates-Windows Components-Internet Control Panel-Disable the Security Page takes care of that.

Want to stop the Windows Messenger from loading for your users? Go to Computer Configuration-Administrative Templates-Windows Components-Windows Messenger, and enable both Do Not Allow Windows Messenger To Run and Do Not Automatically Run Windows Messenger Initially.

In fact, by going to User Configuration-Administrative Templates-System, you can create a tightly locked-down Windows XP interface, deciding exactly which appli­cations to run and which to keep off-limits for users. Some settings (like Logon/Logoff Scripts) are found under both Computer and User Configuration; the settings under the former take precedence over the ones under the latter.

With judicious pointing and clicking, GPEDIT allows you to prevent common user mistakes like deleting important files and folders, as well as to tweak the user interface to suit your users. It will even help you prevent access to removable drives, and to turn off, for example, CD burning - a good idea if you would like to prevent unauthorised copying of data.

Note that GPEDIT has three settings: Not Configured, Disabled and Enabled, which is a bit confusing. Make sure you run GPEDIT in the Extended interface mode (click on the tab in the right-hand pane); doing so displays context-sensitive help text to the left of the items that you are editing, including definitions of what the settings actually do (see FIGURE 1). Enabling a setting can sometimes do the opposite of what you think, and actually disable a system feature.

GPEDIT is a very powerful tool, so explore it with caution. Don't change settings if you don't understand their meaning; you could lock yourself out of the computer. And remember to back up everything before making changes.

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Juha Saarinen

PC World
Show Comments

Cool Tech

Toys for Boys

Family Friendly

Stocking Stuffer

Logitech Ultimate Ears Wonderboom Bluetooth Speaker

Learn more >

SmartLens - Clip on Phone Camera Lens Set of 3

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill


I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?