Probably, today there is not a single person who would not encounter a situation when several people are working on the same computer, and each one logs in with his username and password (the so-called user account in Windows). But far from all users know what “accounting” is and how to change or control its main parameters.
What is a user account?
The term for an account comes from the usual translation of the English phrase User Account. In other words, this is the identification of a user account by a computer system with various levels of access to information, parameters, personal settings, programs used, etc.
No need to explain that we come across accounts everywhere. Even a regular email address on a free mail server - and that can be interpreted as a "user account". The same applies, for example, to online games, users working on computer terminals connected to a local network, programs like Skype, ICQ, etc. In general, if to put it in plain language, these are user registration data. But here all these types of "accounts" differ quite strongly. Now it will be considered the user accounts of Windows 10, as well as 8, 7 and other versions of the OS. Basically, their essence for all "operating systems" remains the same.
What benefits does the user account have?
So, for starters, let's see what are the benefits of an account. First of all, it is worth noting that any user who does not have access rights to information at the administrator level can be completely sure of his own security - from the point of view that no other person, equal to him in terms of access rights, can view his personal files, history of work on the Internet, change personal data or do something else.
It turns out that the system simply hides all these files from prying eyes, but only if the folders and documents are not assigned shared status when absolutely all users of computers located, for example, on the same local or virtual network can use such files . From the point of view of confidentiality, this is very good, and only the administrator of a particular computer or the system administrator of the local network (system administrator) has full access. Let's see what its functions are.
Administrator
As for the main (initially created) administrator account, you can describe such an “account” as granting a single person full access rights to information, changing the configuration of system parameters, installing or removing programs and applications, and also managing other accounts.
In simple terms, the administrator is the most important user for whom there are no restrictions on working with a computer and operating system, and which has exclusive privileges to perform certain actions. And it is the administrator who exercises full control of user accounts with the possibility of granting rights or restricting the capabilities of any other user.
But the most interesting thing is that a computer system (if only one or several OSs are installed) can have one or more administrators. Better - if one. And of course, users with almost the same rights can be present at the same time, however, such a hierarchy can be compared, say, with the army.
Suppose there are two officers with the rank of colonel. But one of them is a regiment commander, and the second is the chief of staff. Title is access rights, position is the type of user. Probably, it is clear that within one unit (computer in our case), the regiment commander has administrator status, and the chief of staff (lower in position) has user status with slight restrictions on rights.
User types
Now let's go directly to the users and groups themselves. As a rule, all types of accounts in Windows are divided into three types: administrator, user with normal access (standard user account) and guest ("guest").
As already clear, the administrator has absolutely all rights, ordinary users are allowed to simply work with a specific computer terminal. Guests are, roughly speaking, strangers with minimal rights (exclusively for entering the system, but no more).
As for groups, the administrator himself can create them absolutely arbitrarily, and in unlimited quantities. In fact, users can be grouped into different groups who enjoy certain rights and permissions, or grouped according to some other characteristic, for example, by belonging to a certain structure in enterprise management (technical department, accounting, etc.).
User Account Control
As for control, the main functions are assigned to the administrator. The system in this case acts only as a means of ensuring compliance with the rights of users or maintaining a certain level of security.
It should be noted that user account control (Windows 7, for example) can be carried out exclusively at the entrance to the system using the username and password of the administrator. No other user has the right to make changes to the settings of "accounts", to provide rights to some actions or to remove restrictions.
It is especially worth noting one important point here. Despite the fact that user accounts are controlled in the system itself, Windows 7 and others, newer versions of the OS can provide users with temporary administrator rights (unless this contradicts the security system and group policy settings). To do this, in the context menu for starting programs there is a special launch line on behalf of the administrator. This approach allows users, for example, to install their own applications or use the same portable versions of programs that do not make critical changes to the registry or do not change security settings.
Account Permissions and Restrictions
As for restrictions on rights, there can be quite a lot of them. The fact is that control of user accounts of the 8th, 7th or 10th version of Windows provides a fairly wide range of what can be allowed or forbidden to a user with certain rights.
So, in most cases, the main restrictions for users below the admin level can be: a ban on access to the registry and its editing, changing security settings or group policy settings.
At the same time, as a result, there is a ban on installing certain programs, using already installed applications or working with certain types of files and folders, reading removable media, etc. This is a reasonable step, since an inexperienced user can easily try to view files on an infected flash drives or install a suspicious program, and if the computer terminal is connected to the local network, the virus can easily migrate to other machines and harm so that absolutely all terminals turn out to be inoperative capable.
That is why in the same "LANs" a rather interesting system configuration is often used . In the standard version, each terminal has its own “OS” (no matter what modification it will be), which works independently of the central server.
In the second case, the computer does not have an operating system at all (sometimes there is not even a hard disk), and the network OS is loaded from a single remote server for all terminals. This type of boot can be seen in the BIOS settings (usually referred to as PXE Boot or Network Boot). The advantages of such a Windows start are obvious, because the user, no matter how he wants it, will simply not be able to change any parameters, even the simplest.
Create an account in Windows
Now, for a while, we will leave alone user account control and consider how to create an “account” of one type or another. As mentioned above, after a clean installation of the system, the user receives administrator rights, and it is he who has the exclusive right to create, delete or modify any account present in the system.
To create a new record on the local computer in the simplest version, go to the corresponding section of the “Control Panel”, then select the creation of a new “account”, enter the name (“Petya”, “Vasya” - it doesn’t matter) and determine the type of record ( normal access or administrator), and then confirm your actions. After that, in the same section, you can create a username and password that will be used when entering the system. You can also change the picture and other parameters available for this registration record. And, of course, passwords and user accounts by the administrator can change even without the intervention of the users themselves. Actually, in some cases (restriction of rights, for example) their consent is not required. But most often this applies to local networks and system administrators, when the user is guilty of something and harmed the system.
Manage your personal account settings
In terms of management, a user account of any level is controlled directly by the administrator. However, the user can change some settings of the system, for example, the background image of the “Desktop”, change the size of windows, etc.
As for the rights to change more serious parameters, they can be provided precisely by the administrator through the control menu in which the specified account is located. Another user cannot change anything. Let's see what settings can be made in this case.
Change basic account settings
First of all, the administrator can configure access rights to the system settings, programs, and some types of files. All this is set either in the above section or in the Group Policy client.
However, you can first use the local users and groups section to add a user. To do this, the lusrmgr.msc command is entered in the Run menu, and the user section is already in the computer control menu, where a menu with the ability to add a new person is called up with a right click. You can add it to the group either through the properties menu, where group membership is selected, and then the name of the working group and the search for names are entered, or through the search for groups with the preliminary use of the "Advanced" button. It remains only to confirm the choice.
If we talk about access rights to certain functions, it is best to use the control settings in the "Control Panel" or in the system configuration (msconfig) with a choice of the service menu and control settings, but more on that later. In the Group Policy Editor , you can also set the appropriate priorities (there are enough settings there).
Delete account
Removing or disabling any “account” can be done from the same “Control Panel”, where in the menu for managing another account the delete line is simply selected (naturally, when logging in as an administrator). That's all.
Then the user, when trying to enter the system, can then receive a notification that the user account is disabled. It will not be possible to restore it after deletion, so you will have to create a new one on behalf of the administrator. However, when deleting a record, you can save user files that will be available at the end of the procedure.
Disabling user control through the "Control Panel"
If we talk about how to disable user account control, the first thing to do is use the “Control Panel”.
Here you need to select the options menu, and in the window where the vertical slider is located, simply move the latter to the lowest position corresponding to the “Never notify” option, which means only that the system will not give warnings about making changes to the configuration in passing.
Disabling user account control via the command line
As mentioned above, in the "Run" menu, you can use the msconfig command with the transition to the "Tools" or "Tools" section, where you select the setting that corresponds to user account control.
Select this line, then click the "Run" button, and then perform the steps indicated above. However, you can simplify access to disconnection by immediately entering the string UserAccountControlSettings.exe as a command. Further all the same.
You can, of course, use the registry editor with the EnableLUA parameter changed (changing the value to “0”), which is located in the Policies \ System branch of the HKEY_LOCAL_MACHINE \ Software main tree and beyond, or using the Windows command handler (in both cases, the user account will remain unchanged, and control over it will be disabled). However, these methods will be somewhat complicated for the average user.
Instead of an afterword
Here in a nutshell, and everything that relates to what is the "account" and the control of user accounts on the local computer. The topics related to the similar actions of the administrator of the local network were not considered here, but, in principle, it could be said that all the basic procedures are practically the same, except that sometimes some changes and settings may affect the Internet protocols. But this, as they say, is another matter.