How Do I Allow A Standard User to Install Programs?

Question

Yes, I realize that defeats the purpose of standard user. But here is the situation. A friend of mine wants to set up time limits for his home schooled son, and his son needs to be a standard user in order to use Family Safety. But at the same time, his son (who I personally think is way too old to have time limits), needs to be able to update and install some of his games on his computer. So I guess it's just sort of "light" parental control (just something to help him focus and not get distracted with hours of gaming).

It is the basic version of Windows 8.1, so there is no Group Policy editor (gpedit.msc). However, I'm fairly good with computers and I figured out how to install it. But it doesn't have a lot of the features that the "real" gpedit seems to have. Here is an example of what is in my gpedit:

Answer 1

YES!!! I did it!!! Here is what I did:

1. Click Start and type cmd. When cmd.exe shows up, right-click and select Run as Administrator (this allows you to run Command Prompt at an elevated level).
2. Type net localgroup Power Users /add /comment:"Standard User with ability to install programs." and hit enter.
3. Now you need to assign user/group rights. Download ntrights.exe from here. These are the instructions from sevenforums:

A) Open the downloaded .zip file, and extract (drag and drop) the ntrights.exe file to your desktop.

B) Right click on the ntrights.exe file, click on Properties, General tab, and click on the Unblock button if available. NOTE: If you do not have a Unblock button under the General tab, then the file is already unblocked and you can continue on to step 1C.

C) Right click on the ntrights.exe file and click on Move.

D) Open Windows Explorer and navigate to and open the C:\Windows\System32 folder, then Paste the ntrights.exe file to move it here.

E) If prompted, click on Continue and Yes to approve moving the ntrights.exe file into the System32 folder, then close the Windows Explorer window.

4. In an elevated command prompt (see step 1), type ntrights -U "Power Users" +R SeNetworkLogonRight and hit enter. Type in the same thing again, only change SeNetworkLogonRightwith something else. You can try the following:
   • SeInteractiveLogonRight
   • SeChangeNotifyPrivilege
   • SeSystemtimePrivilege
   • SeTimeZonePrivilege
   • SeCreatePagefilePrivilege
   • SeCreateGlobalPrivilege
   • SeCreatePermanentPrivilege
   • SeIncreaseWorkingSetPrivilege
   • SeIncreaseBasePriorityPrivilege
   • SeLoadDriverPrivilege
   • SeSystemEnvironmentPrivilege
   • SeManageVolumePrivilege
   • SeProfileSingleProcessPrivilege
   • SeSystemProfilePrivilege
   • SeShutdownPrivilege

For a complete list of User Rights and explanations, see my comment below (I can't post more than two links; if someone wants to edit this to add the link, please feel free).

5. Once that is complete, you then need to give your new "Power Users" group permission to write to the C drive. Open my computer, right click on the C drive, and go to Properties. Click on the Security tab. Click on Edit... then Add... and in the big box under Enter the object names to select type Power Users and click Check Names and click OK.
6. Under the heading Group or User Names, you will see "Power Users." Click on it, and click on the checkmark beside Full Control. It should automatically check off everything else, but if not, manually check everything else. The only thing that you can't check because it is grayed out is Special Permissions. Click Apply, and it will give your group permissions. Ignore any errors that come up and continue anyway (I think assigning group rights in step 4 took care if this).

7.Open an elevated command prompt again (step 1), and type net localgroup "Users" "Power Users" /ADD This nests your Power Users Group within Users so that way it is basically a Standard User account, but with additional privileges.

8. Type net localgroup "Power Users" user_000 /ADD(user_000 being the user name for the account you are trying to keep as a Standard User and allow to install programs). This will still keep your user in the Users group, but will also add the user to the new Power Users group (so it is part of multiple groups). Note: If your user is signed in with a Microsoft Passport, you can find out your username by clicking on Startand typing control userpasswords2 and hitting enter. Then click on the user account you need to find the name for, and click Propertiesand you'll see your actual user name.

ALL DONE! And you will notice that Family Safety is still enforced, yet the user can't change its settings or give additional time or unblock websites or whatever. Nor can the user add another user with the User Accounts feature. Yet the user can install programs. :)

Answer 2

Parental Controls (or Family Safety) may no longer the correct tool for the task. Depending on the larger situation, alternative approaches may be appropriate:

1. Perhaps adding son's account to the power user user group might be enough (though I'm uncertain about its access to the Parental Safety features). Power users have privileges beyond the general Users class, but aren't precisely full-fledged admins. This summary of the differences is old, but generally relevant.

2. Perhaps restricting access to the Internet through the router is an option. Some homes, for example, limit device access to the Internet in order to encourage sleep. The actual process varies according to the actual router (the linked instructions are for Linksys), but should be relatively easy to locate using your preferred search engine.

3. More ambitiously, you could setup a proxy server and limit access to specific sites throughout the day. This sounds far difficult than it is, though it can be done quite inexpensively these days using either custom router firmware or even an older, dedicated PC.

In my experience, Family Safety is good for a certain set of scenarios, but no replacement for proper access management. Also, it may be time to consider upgrading Windows to a Pro SKU or even a more recent version that no longer uses a Home SKU.

Hope this helps...

-- Lance

P.S. The problem facing the privilege elevation approaches suggested so far is that they require access to elevated credentials. You either end up saving elevation credentials to the hard drive (a security no-no) or you end up having to provide credentials anyway, thus not saving any time/effort. The underlying problem, really, is one of trust and time management. That's a parental question that no software can really manage effectively. (That's my personal opinion, yours may vary.)

Answer 3

Try to find some app that elevates the user, in a enterprise environment you can use Avecto's Privilege Guard... Might be some similiar for home usage, like this:

http://www.techrepublic.com/blog/windows-and-office/elevate-privileges-automatically-with-elevation-powertoys/