Hi Folks, I need a hint to an annoying problem:
The Windows XP of my parents has multiple users, one for my stepfather, one for my mother and one for my brother. My parents are admins, my brother isn't (he's just 11).
It seems like when my mother creates a file/folder that my step father can't delete it. I assume that's because of ownership of that file. Windows just locks it for write actions of another user. This is basically a good idea, but I want this behavior confined to the respective user profiles, not any folder on the harddrive.
Admins should be able to alter anything (without having to change ownership beforehand, because that's not something I can expect my parents to learn.) And when I temporarily give admin rights to my brother he should be able to do the same.

So which menus do I have to poke around to set that?

Another, probably related, problem is that my brother isn't allowed to create folders on the C:\ drive (system). How can I fix that?

Post has been edited 1 time(s), last time on Dec 22 2010, 3:29 pm by NudeRaider.

I don't know of a way to give admin complete control over everything in windows because a user admin isn't really an admin. You could switch to linux where admin is admin, though. You might be able to give both of them full control to everything except stuff in their folders, and that might stick for newly created items in a folder which the person has full control over.

As for the C drive, just give him write privileges. (right click, properties, security, don't apply to subfolders)

Linux is not an option.
What do you mean with an admin is not an admin?
When I give my brother access to *just* C:\ (without subfolders) then he still wouldn't be able to create a folder in C:\Program Files\ for example, right? So how do I give access to him to everything except the other family member's user profiles?

I've just scratched the surface about all these security policies and user statuses as I never needed it with my own computer where there's only a single user. So I think I need a quick tutorial to make heads and tails of it (a good link would be fine). I got a general idea so I could just use trial and error from there, but I'd rather know what I'm doing beforehand. I'm afraid I might remove my own access to change the settings or something stupid like that.

So here's a picture and I got a couple of questions about it.

(Don't be confused, I'm fairly certain VIRTUAL is just the name of the computer)

- Who belongs to group ADMINISTRATORS? (From what rockz said I suspect admin users don't?)
- Power Users is a custom user group or what? How do I manage these? Would I need it in my scenario explained in the OP?
- How is SYSTEM defined? Is that the priviledges any part of the windows background processes/services are assigned? What if I'd manually run such a process with a certain user?
- Users is basically anyone that has a manually created account, right? Lowest level access.

- What exactly is full control? Do I need the other priviledges when full control is ticked? What if full control is allowed, but write is denied?

I think that's enough for now. I might ask more later.

I was having some problems with file ownership when I reinstalled Windows over my existing copy. It got really bad when it came to removing old registry entries I didn't have permission for.

I forget exactly where, but there should be an option to apply permissions to all files and subfolders when you're changing them.

To be honest, I don't have this group on my computer and I haven't heard of it. Generally, I would assume it's supposed to be a selected group of users who know what they're doing and therefore can be trusted with more permissions.

SYSTEM is the same SYSTEM that runs all the Windows background processes and services in Task Manager, such as winlogin.exe and services.exe. What would happen if you were to run SYSTEM process yourself? I have no idea and would suppose it depends on the program.

I would assume that any user fits under users. But, that is an assumption.

Full control should mean you can do anything. It's also easier to check or uncheck full control rather than every checkbox. Does it uncheck when you uncheck one of the lower options, such as write?

The reason I say admins aren't admins is because by default, an administrator should have access to every file everywhere. That's obviously not the case in windows.

I'm currently on a "locked down" computer at work. here, I'm not specifically listed in the user (perhaps you'll need to do that?) and I'm not sure if I even belong to one of these groups. It seems like a major oversight on Microsoft's part. As a result, I can create files in C:\, and delete files that I put there, but I can't delete files I didn't put there.

Same deal with System32 (oddly enough). However, I can't put stuff in the themes folder. Pretty stupid, because I shouldn't be able to put stuff on anything except for my profile.

... and then remove access for all profile folders except his own. Right, that should work.

Uh thanks guys, pretty much what I was thinking too, but I'd still be interested in more solid info or a tutorial or something.

Oh and can anyone explain to me what I can do with group policies (gpedit.msc)? This looks relevant.

Thats where the feature youre looking for would be located, that or another one of the Administrative Tools items. Im not completely sure because my college is teaching me Windows 7, and I dont have a XP handy.

Ill try looking for it when I can get a hold of my brothers compy.

fyi. gpedit.msc is on 7 and vista and is virtually identical. It's pretty much a series of registry tweaks. I've never looked around in it enough.