Securing and protecting a shared computer

Question

I allow friends and relatives to use my home computer, but I'd like to secure it as much as possible, and so I have a few questions:

1. How can I require an admin password (that only I know) for any software installs?
2. How can I make any programs they might have installed or files they might have downloaded go away when the computer is restarted?
3. How can I prevent people from changing system settings, like in the control panel, unless I use the admin password?

Answer 1

if you mean installing the software instead of downloading it, the user accounts on windows who are not in the administrators group, that is who are standard users are required to do most part of such things with administrator's permission, that is by inputting one of the users' password who is in the administrators group

you can open cmd.exe (win+r, then type cmd) and type:

net localgroup administrators

to view administrator users, and:

net localgroup users

to view standard user accounts in your computer

ps:

to add a user into standard users group, you can issue the following command:

net localgroup users username /add

Answer 2

As I mention above, the Guest account would work best. You'll need to follow best practices though to get the best use out of it.

1. Open the Control Panel, select Users Accounts. You'll need to choose the option to manage other user accounts (I'm not sure the wording, as I'm on a domain PC). You may need to click on the Yes button to continue.

   Choose the option to enable the Guest account. Windows will give a small blurb about it. This account will have the least amount of privileges by default. This is what you should let your friends log in as.

2. On your account, make sure you have a strong password that they won't be able to guess. Keep it to yourself, don't let ANYONE know what it is.

3. Ensure the UAC level is set to the highest possible. This will require your friends to beg and plead for changes to happen, but keep your system safe and secure. If you are not constantly watching what they're doing or accessing, do NOT type your password into a UAC prompt while they're logged in; for all you know, they could have built a basic UAC prompt in a web page, or downloaded a keylogger. With that...

4. Log out, then log in as your account to make changes system wide. If there need to be changes to the Guest account, then tell them too bad. The Guest only has access to the shared folders on the system (Public Documents, Public Pictures, Public Downloads, Public Music, Public Videos, Public Desktop, etc), and it should be kept this way. If they want access to something else, either supervise them closely, or create their own account, and add them to the Guests group.

   To add them to the Guest Group (if they have their own username), open the Command Prompt as an Administrator (Start, type cmd and press Ctrl+Shift+Enter). Run the following command, replacing <username> with their username you assigned them:

   net localgroup Guests <username> /ADD

   After you press Enter, and the user logs in again (they need to log out completely if you only did a Switch User), they will have all the rights of the Guest account, but be able to change their own files on their account. It is more restrictive than the Standard User, and therefore, likely to be more secure.