Chapter 26. Separating Users Gives Each the Access They Need
In This Chapter:
- Learn about Administrator and user accounts
- Assign user account passwords
- Change user account settings
- Change your user account’s picture
- Increase or decrease a user account’s security level
- Manage multiple users
- Protect your user account’s files
Microsoft designed Windows Vista to be a multiuser operating system. On one computer, several people can access Vista and manage their own set of files, their own Vista look and behavior, and abide by the security settings given to them by a user on the computer who uses an Administrator user account. When someone first installs Vista on a computer, that user—the first user—has Administrator privileges and can create accounts for other users that might or might not have full privileges. A user account without full system privileges is called a Standard user account.
It’s not the goal of this chapter to dig too deeply into security because that is a subject that deserves the attention that only a full chapter can give. The next chapter, “Managing Your Windows Security,” explains how you can manage your computer’s security. This chapter teaches you the first step: how to create and manage user accounts to give other members of your family or business access to your Vista computer.
About User Accounts
When you open your Control Panel’s User Accounts and Family Safety group, one of the items you see is the User Accounts option. Selecting User Accounts opens a User Accounts window similar to the one shown in Figure 26.1. Your User Accounts window will certainly look somewhat different from the figures, depending on whether other users are set up.
Figure 26.1. You add, view, change, and delete user accounts from the User Accounts window.
One of the ways you most quickly learn about setting up and modifying user accounts is to begin adjusting the settings of your own user account. The next section shows you how to do just that. After you become familiar with modifying your own account, you’ll be ready to set up accounts for others.
By the Way
To modify user account settings, you must have Administrator privileges. If you see your username and the title Administrator, you have that privilege. If you have only a Standard account, you have to gain administrative privileges to change some aspects of your own account and to add or modify other user accounts.
Make the Most of User Accounts
When you have a user account on a computer, you have your own set of files and Vista settings. The desktop background wallpaper image you see might be unique to you and you can change it to suit your preferences. You can adjust your screen’s resolution to see more items on the screen or to see fewer items at a larger size. The data files you create are yours, and stored in a Documents folder assigned to your user account.
Your user account name and optional password give you access to your computer defaults. When you finish working on your computer and you want to make it available for someone else, open your Vista Start menu, click the arrow next to the padlock at the right of your All Programs group, and select Log Off (see Figure 26.2). Doing so closes your current session, prompts you to save any data files you have not saved yet, and logs you off the computer. Anyone else who uses your computer will then log on to their user account to access their files, their settings, and the computing environment they have set up. When they finish, they should log off to make it easy for you and others to log on again when you’re ready to use the computer. To use the machine once again, you will have to click your username and enter your user password (if you use a password).
Figure 26.2. Log off when you finish your computer session to make it easy for others to log on to their user account and to make it difficult for them to use your user account.
Watch Out!
Always log off when you finish your computing session if others might possibly need to use your computer. It’s incumbent upon you or a user with Administrator account privileges to assign to each user his or her own unique user account. Obviously, if you password-protect your user account, you help protect your account from unauthorized access. Whoever uses your user account will have full access to your files and settings. Even if they intend no malice, another user who uses your account because you forgot to log off can inadvertently change your computer’s settings or accidentally delete files that you didn’t want removed.
If you’re the only one who uses your computer, you don’t have to set up additional user accounts. There is an advantage, however, to setting up a second account for yourself that does not have administrative privileges. You might want to use that account for your routine computer work and save your administrative account for system changes that you must sometimes make. This keeps you and the programs you run from inadvertently changing a system setting that could cause problems. The chance of this is unlikely because even an administrative account user must confirm just about any risky behavior by confirming the action in a dialog box, but it’s good peace of mind.
If you share your computer with someone you trust, both of you routinely work with the same sets of files, and both of you prefer the same basic system settings, you don’t have to set up an account for each user. You can both use the same account. If you elect to do this, be sure that you and the other users have similar computer knowledge and that both of you know enough to accept system requests such as Vista and security updates. (Only administrative accounts can accept system and security updates when prompted.)
Did you Know?
Even if you and one or more others share the same computer, have full trust in the other, and each understands security issues and knows when to accept system updates and such, having multiple accounts still makes the most sense. You can easily set up files and folders that are shareable between users on the computer from different accounts. If you decide not to set up multiple user accounts for now, it’s simple to add user accounts later if you decide to.
Working with Your User Account
Select User Accounts from your Control Panel’s User Accounts and Family Safety group to display the User Accounts window shown in Figure 26.3. If you’ve not yet set up a password for your account, you won’t see the Password protected notice beneath your user ID, and your password options to the left of your account’s picture will differ slightly from those in the figure.
Figure 26.3. Making changes to your own user account.
Assigning a User Account Password
If you haven’t assigned a password to your account, go ahead and do so now to see how simple adding a password can be. If you don’t want to keep a password on your account, you can remove it later. Click to select the Create a Password for Your Account option to display the password entry window shown in Figure 26.4. Type your password twice, once in each of the two text boxes. When you begin typing the first password, the placeholder text New password disappears.
Figure 26.4. You must enter your password twice to verify its accuracy.
As you type, notice Vista doesn’t display your password but instead displays dark circles for each character you type. This protects your password from prying eyes that might be looking on. Because your password doesn’t show, you could accidentally type a mistake in the password and be unable to log on to your account because you won’t know exactly what you typed for the password. By requesting the password twice, Vista helps verify that the password is accurate by assuming that if you type the same password twice, you typed the correct characters. If you make a mistake and the two passwords don’t match when you click the Create Password button later, Vista tells you about the problem and displays this screen once more so that you can enter your password more carefully.
Although it’s optional, you should type a password hint in the bottom text box. If you forget your password, Vista displays this hint to remind you of what you used for the password.
Suppose you use Chevy97 for your password. Your password hint might be Car and year. Obviously if you have a 1997 Chevy sitting in your driveway that password hint provides a little too much information. Design your hint so that you can figure out by looking at it what you used as a password, but others won’t be able to.
When you click the Create Password button, Vista assigns that password to your user account. The next time you log on to Windows, you’ll be prompted for that password when you select your user account. Without the password, nobody can use your account.
Deleting a Password
If you ever want to delete an account’s password, you must know that account’s password before you can delete it. To delete a password, click the Remove Your Password link. Vista prompts you for the password assigned to the account.
This helps protect you in case you walk away from your computer and forget to log off. Someone could quickly go in and delete your account’s password without you knowing they did so. By asking for the password before deleting it from the account, Vista helps to ensure that the user deleting the password is the owner of that account.
Changing Your Account’s Picture
The user account picture that appears doesn’t have any function other than aesthetic purposes, but it’s nice to use something you associate with. Perhaps you’ll even use your own photo, as might be done in a multiuser business setting. Windows Vista lets you select from a list of pictures or supply one of your own.
To change your picture, click the Change Your Picture link. Vista displays a selection of pictures from which you can choose as shown in Figure 26.5. Your currently selected user account photo (which Vista assigned if you never selected one yourself) is the top photo and a list of choices appears below it.
Figure 26.5. Use this window to select a new picture to associate with your user account.
If you like one of the pictures in the window, click to select it and then click Change Picture to change your current account’s picture to the new one. If you want to use your own picture, you first need to store the picture in your account’s Pictures folder. When you click the Browse for More Pictures link, Vista opens your Pictures folder from which you can select a picture. Select a picture and click Open, and Vista uses that picture for your user account’s photo. Since your user account picture always appears in a square frame, you should select an image that is already in a square shape. If your selected image is too wide, Vista will have to squeeze the sides to fit the image into your user account picture frame and the image will not look as good if you begin with an image that is already fairly square in shape.
Changing Your Account’s Name
To change the your user account’s logon name, click the Change Your Account Name link to display the Type a New Account Name window. Type a new name and click Change Name to change your account’s name. This name will appear on your Welcome screen as well as the Start menu, and so will your photo, as Figure 26.6 shows.
Figure 26.6. Windows displays your user account’s name and picture atop your Start menu.
By the Way
Vista displays your name and picture above the Start menu in an attempt to keep your computer as secure and accurate as possible. Suppose that you sat down at your computer and someone was already logged on. If you were rushed, you might assume that it’s your account, but as soon as you open the Start menu you would see that someone else is logged on. You then can log off and log on to your user account to get access to your files.
Changing Your Account’s Type
You can change an Administrator account to a Standard account and you can change a Standard account to an Administrator account. If you own the only Administrator account, however, you cannot change your account to a Standard account. You can add a second user account for yourself and make it a Standard account. Every computer requires at least one Administrator account because no system changes are possible with it.
Working with Multiple User Accounts
The previous sections will come in handy whether you use a single account computer or a computer that you share with others. You can modify your own user account settings as well as other user accounts as long as you have an Administrator account. If you have a Standard account, you can change only your account password and picture. You are not allowed to change your account’s name or account type if you own a Standard account.
Did you Know?
If you own multiple accounts and one of them is an Administrator account, you can change all aspects of your Standard account even when logged in to your Standard account because when you attempt to change one of the secure Standard account’s settings, such as the password, Vista stops and asks you for the Administrator’s password. If you type the Administrator password correctly, Vista lets you change one of the secure user account settings, such as the account type.
When logged in as an Administrator, you can change anyone else’s user account settings. Click the Manage Another Account link to display the Manage Accounts window shown in Figure 26.7.
Figure 26.7. An Administrator can modify settings of any user account on the computer.
Select the account you want to modify. For example, you might select a Standard account so that you can upgrade that user account to have full administrative privileges. You can also create a new user account here and downgrade another user from an Administrator account to a Standard account. Finally, you can completely delete another user’s account by selecting the account after clicking the Delete the Account link.
About the User Account Control
You cannot modify system-level settings when using a Standard account, as you’ve already learned. In reality, you can, but you must know an Administrator account’s password if you want to remain inside a Standard account and make system settings.
Suppose, for example, you’re logged in to a Standard user’s account and you attempt to upgrade your Standard user account to an administrative level. Windows Vista will first display a User Account Control (UAC) dialog box and ask you to type an Administrator user’s password. If you type the password correctly, Vista assumes that you have administrative privileges in another account even though you’re logged in to a Standard account. At that point, you can make the change you want to make. All the User Accounts window’s entries marked with a security shield (see Figure 26.8) require Administrator-user level confirmation before they can be changed.
Figure 26.8. The security shield icons mark the items for which you need Administrator privileges before you can change them.
By the Way
All Control Panel routines that use UAC to require Administrative privileges to run display the UAC shield next to their names.
Windows Vista utilizes a new security concept named User Account Control to protect your system from inadvertent system changes that could affect the system and other users. In a nutshell, the UAC sets up two security levels for every Administrator account and one for each Standard user account. When you log on as a Standard user, you are allowed to access only your own files and have a limited set of tasks you can perform. In general, this will not limit your typical use of your computer, but it does limit any system-level changes you can make, such as being able to upgrade your account from a Standard account to an Administrator account. If you attempt such a task when logged on as a Standard user, Windows prompts you for an Administrator user account’s password as described at the beginning of this session.
If you’re logged in as an Administrator user, Vista creates two security levels for you. The default security level is a Standard user account. If you, as an Administrator, attempt to run a system program such as the Disk Defragmenter, Vista temporarily blocks you from doing that and asks that you confirm that you truly want to run that system program. All you need to do is click Continue and Vista elevates your security level and allows the program to run. You don’t need to type your Administrator user password because by logging in to that user account to begin with, you entered the password.
By the Way
Think of the confirmation as a reminder to you, an Administrator, that you’re about to do something that could cause potential harm or affect files belonging to other users. It’s fine if you click Continue and go ahead with the task, but Vista is just temporarily stopping you from doing so to remind you of the critical nature of what you might do next.
Previous Windows versions didn’t do this. If you had administrative privileges, you always ran as an Administrator. It made Windows easier to use when you were updating other user accounts and running system programs because you weren’t stopped all the time to confirm that you really wanted to do what you’d requested. Then again, you didn’t have the second-chance warning that the confirmation provides.
By the Way
Software developers determine the level of the user account needed to run programs. An application is either a Standard user application or an Administrator user application, and Vista determines which it is before running the program so that Vista can let the UAC handle the confirmations when required.
If you do not want to see the UAC-based confirmation dialog boxes when logged in as an Administrator, you can turn them off. Select your Administrator user account to modify in the User Accounts window and select the option labeled Turn User Account Control On or Off. As you might now expect, Vista prompts you with a confirmation dialog box before you can even get to the window to turn off the UAC controls on your account. After you confirm, the Turn User Account Control On or Off window, shown in Figure 26.9, appears. Inside the dialog box, Vista recommends leaving the UAC turned on, but if you click to uncheck the option and then close the dialog box, Windows no longer bothers you as an Administrator when you attempt to do anything that requires administrative privilege to run. You will need to reboot your system to implement this change and once you do, you won’t see the UAC messages.
Figure 26.9. You can turn off your Administrator user account’s UAC confirmations, but Windows Vista doesn’t recommend that you do so.
Switching Between User Accounts
When logged in to a user account, whether it’s an Administrator user account or a Standard user account, you can switch to a different user account at any time. When you switch user accounts (as opposed to logging off your account first), all the programs and windows you currently have open remain open in your account.
Did you Know?
The ability to switch users is helpful when you’re working on your computer and someone else with access to your computer needs to do something quickly. The other user can switch to her or his user account without logging you off first, do whatever it is that needs to be done, and then log off. You’ll select your user from the list that appears (the message Logged on appears in the user list you select from, indicating that your account wasn’t logged off and might still have programs and windows open) and Vista puts you right back where you were before the interruption.
Watch Out!
Obviously, before letting someone else switch users from your account, or use their account in any way while yours is still logged on, you should stay there to make sure that nothing takes place inside your account that might cause problems with your files or settings. If your account is password-protected, as all Administrator user accounts should be, after another user’s account is logged in, your account can no longer be switched back to without your password. Even so, completely logging out of your account before letting someone else take over the computer for a while greatly increases the likelihood that your files will be safe. If the user turns off the power switch, for example, while your account still has open files, you could lose data.
To switch to another user account without first logging off your account, display the Start menu, click the arrow to the right of the padlock at the bottom of the Start menu’s left pane, and select Switch User. Vista displays a user list so that the next user can log on while keeping your programs and windows open in your user account so that you can return to them.
Chapter Wrap-Up
You now understand the importance of user accounts and account settings. The Administrator user level is far more privileged when it comes to making system changes than a Standard user account is. For typical computing, however, the Standard user account provides access to routine programs and that user’s data files, so running from a Standard user account isn’t a severe penalty unless you need higher access to do something.
Security permeates Windows Vista and, as you’ve seen in this chapter, security is of prime importance when working with user accounts. In the next chapter, you will learn more about Windows Vista’s security features. In today’s world, running in a safe computer environment helps ensure that your system runs as smoothly as possible.