What are the differences between power user and administrator on Windows XP Pro?

Answer 1

Members of the Administrator group have total control over the computer and everything on it. The user named Administratoris the default account within this group. The domain account of each faculty or staff member with a Windows 2000 computer is part of the Administrator group on his or her computer. == * Create, modify, and access local user accounts * Install new hardware and software * Upgrade the operating system * Back up the system and files * Claim ownership of files that have become damaged * Do anything a Power User can ---- The Power User class can perform any task except for those reserved for Administators. They are allowed to carry out functions that will not directly affect the operating system or risk security. All domain accounts are part of the Power Users group on public Windows 2000 computers. == * Create local user accounts * Modify user accounts which they have created * Change user permissions on users, power users, and guests * Install and run applications that do not affect the operating system * Customize settings and resources on the Control Panel, such as Printers, Date/Time, and Power Options * Do anything a User can == * Access other users' data without permission * Delete or modify user accounts they did not create Members of the Administrator group have total control over the computer and everything on it. The user named Administrator is the default account within this group. The domain account of each faculty or staff member with a Windows 2000 computer is part of the Administrator group on his or her computer. == * Create, modify, and access local user accounts * Install new hardware and software * Upgrade the operating system * Back up the system and files * Claim ownership of files that have become damaged * Do anything a Power User can ---- The Power User class can perform any task except for those reserved for Administators. They are allowed to carry out functions that will not directly affect the operating system or risk security. All domain accounts are part of the Power Users group on public Windows 2000 computers. == * Create local user accounts * Modify user accounts which they have created * Change user permissions on users, power users, and guests * Install and run applications that do not affect the operating system * Customize settings and resources on the Control Panel, such as Printers, Date/Time, and Power Options * Do anything a User can == * Access other users' data without permission * Delete or modify user accounts they did not create

Answer 2

Administrators

Adding users to the Users group is the most secure option, because the default permissions allotted to this group do not allow members to modify operating system settings or other user's data. However, user level permissions often do not allow the user to successfully run legacy applications. The members of the Users group are only guaranteed to be able to run programs that have been certified for Windows. For more information on the Certified for Windows Program, see the Microsoft Web site. As a result, only trusted personnel should be members of this group.

Ideally, administrative access should only be used to:

• Install the operating system and components (such as hardware drivers, system services, and so on).

• Install Service Packs and Windows Packs.

• Upgrade the operating system.

• Repair the operating system.

• Configure critical operating system parameters (such as password policy, access control, audit policy, kernel mode driver configuration, and so on).

• Take ownership of files that have become inaccessible.

• Manage the security and auditing logs.

• Back up and restore the system.

In practice, Administrator accounts often must be used to install and run programs written for versions of Windows prior to Windows 2000.

Power Users

The Power Users group primarily provides backward compatibility for running non-certified applications. The default permissions that are allotted to this group allow this group's members to modify computerwide settings. If non-certified applications must be supported, then end users will need to be part of the Power Users group.

Members of the Power Users group have more permissions than members of the Users group and fewer than members of the Administrators group. Power Users can perform any operating system task except tasks reserved for the Administrators group. The default Windows 2000 and Windows XP Professional security settings for Power Users are very similar to the default security settings for Users in Windows NT 4.0. Any program that a user can run in Windows NT 4.0, a Power User can run in Windows 2000 or Windows XP Professional.

Power Users can:

• Run legacy applications, in addition to Windows 2000 or Windows XP Professional certified applications.

• Install programs that do not modify operating system files or install system services.

• Customize systemwide resources including printers, date, time, power options, and other Control Panel resources.

• Create and manage local user accounts and groups.

• Stop and start system services which are not started by default.

Power Users do not have permission to add themselves to the Administrators group. Power Users do not have access to the data of other users on an NTFS volume, unless those users grant them permission.