Change user's privileges Windows 7

Question

How can I change user privileges in Windows 7 Ultimate? I need that a User can only execute installed software, write in his own Documents Folder and cannot install other programs.

Answer 1

One way I can suggest is setting up the user and "Taking Ownership" (or adding ownership) of various folders/file/programs but keep as a regular user so that they are unable to install additional software.

Here's how you can add a "Take Ownership" context menu: http://www.howtogeek.com/howto/windows-vista/add-take-ownership-to-explorer-right-click-menu-in-vista/

--- Raw info ---

Add Context Menu by saving as .Reg file, then execute.

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\*\shell\runas]
@="Take Ownership"
"NoWorkingDirectory"=""

[HKEY_CLASSES_ROOT\*\shell\runas\command]
@="cmd.exe /c takeown /f \"%1\" && icacls \"%1\" /grant administrators:F"
"IsolatedCommand"="cmd.exe /c takeown /f \"%1\" && icacls \"%1\" /grant administrators:F"

[HKEY_CLASSES_ROOT\Directory\shell\runas]
@="Take Ownership"
"NoWorkingDirectory"=""

[HKEY_CLASSES_ROOT\Directory\shell\runas\command]
@="cmd.exe /c takeown /f \"%1\" /r /d y && icacls \"%1\" /grant administrators:F /t"
"IsolatedCommand"="cmd.exe /c takeown /f \"%1\" /r /d y && icacls \"%1\" /grant administrators:F /t"

Then when you're done adjusting privileges/permissions you can remove the context menu by running this:

Windows Registry Editor Version 5.00

[-HKEY_CLASSES_ROOT\*\shell\runas]

[-HKEY_CLASSES_ROOT\Directory\shell\runas]

Answer 2

You'll need to do some googling to lookup local group policy on windows 7. Setting the user as a standard user would help to block them from installing applications with the use of UAC and Group Policy restrictions in place.

Two factors need to be considered when restricting access rights. What is the user allow to do and what is the user forbidden from doing.

Based on that criteria, you should research what permissions should be granted and denyed. As an example, allowing the user read/write permission to thier document folder will allow them to save. Allowing them read only permission to the desktop, will allow them to see the icons but not create any new ones. Your topic can become very complicated depending on how much you wish to lock down from the user. I would advise to test one setting at a time logged in as the user. Then move on when you feel it works correctly.