Windows7 account and permissions explore

Why log in with an administrator account, trying to uninstall a file in a system, or prompt insufficient permissions? This article introduces you to the mystery of the account and permissions of Windows 7 (hereinafter referred to as windows
7).
Basic Courses ——Understanding Permissions

Windows 7 permissions are closely related to accounts. According to the order of permissions, the windows7 system accounts can be divided into the following four categories:

Guest account (Guest): System built-in account, mostly used for temporary access computer
. You cannot install software and hardware after logging in to the system with a guest account, and you cannot change settings or create passwords.

Standard account: created by the user, can perform most of the daily operations, but can not change the important settings of the system, such as not running "disk management" partitioning the hard disk.

Administrator account: You can control the computer at the highest level. By default, you have administrator rights. There are two main types of administrator accounts:

One type is created by a netizen. Although this account has administrator rights, you can use manual authorization when you change the important settings of the system. When the account control prompt pops up, click "yes") to actually have administrator privileges; the other is the system built-in (such as Administrator) account, which does not need to manually lift the system to change the important settings of the system, but it is important to When the files in the system are uninstalled, renamed, etc., they are still "unauthorized" by default.

Special Account: It has higher privileges than the administrator account. There are two special accounts:

1. TrustedInstaller account: a virtual account, full name "NT service\\TrustedInstaller" By default, full control permissions for files on all systems are always granted to that netizen. In the permissions window of the file in any system, you can observe that only the "TrustedInstaller account" has full control permissions, and the Administrators group (the Administrator account belongs to this group) can only read "and"read and execute " This is why the Administrator account cannot be used to uninstall files in the system after logging in to the system.

2.SYSTEM account: Windows7 system built-in account, system services, account login and many background processes always run with this account. Unlike the Trustedinstaller account, SYSTEM is a real account that can be logged in using special practices.
Improve the course ——change permissions

To make the Administrator account have "full control" permissions, step 1 to take ownership of the file (clip), you only need to import a registry The file (this registry file can be downloaded at http://bbs.icpcw.com/forum.php?mod=viewthread&tid=2147408), you can add a button to the right mouse button. When you encounter a file that cannot be uninstalled due to insufficient permissions, just right-click on the file and select "Administrator Takes Ownership", and you can easily uninstall the file.

Tips| Tips

Letting the TrustedInstaller account ownership of the system files can effectively protect the system security. After changing the file ownership in the system using the above method, if you need to restore the default settings, just change the file owner to "NT service \\TrustedInstaller", and set the permissions to "full control" just fine.
After class summary —— Someone is the highest

Through the above introduction, everyone knows that by default, the Trustedinstaller account has the highest authority for files in the system. However, the maximum privilege of the Trustedinstaller account is limited to the files in the system. The files created by the netizens will not assign permissions to the Trustedinstaller account.

Which account has the highest system privileges? The answer is: an administrator account for the "Full Control" permission for all files. In other words, the permissions are for files (folders), and an account has ownership and full control of all folders, then the account has the highest authority for such a system.
"Computer News" October 24, 2011 edition of the 42 F12 Author: Yu, Fujian wood hair
& ldquo; get administrator rights & rdquo; the following content copy, save to file reg

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\\*\\shell\ unas]@="Administrator Ownership""NoWorkingDirectory"=""[HKEY_CLASSES_ROOT\\*\\shell\ unas\\ Command]@="cmd.exe /c takeown /f \\"%1\\" && icacls \\"%1\\" /grant administrators:F""IsolatedCommand"="cmd. Exe /c takeown /f \\"%1\\" && icacls \\"%1\\" /grant administrators:F"

[HKEY_CLASSES_ROOT\\Directory\\shell\ unas]@= "Administrator Ownership""NoWorkingDirectory"=""[HKEY_CLASSES_ROOT\\Directory\\shell\ unas\\command]@="cmd.exe /c takeown /f \\"%1\\" /r /dy && icacls \\"%1\\" /grant administrators:F /t""IsolatedCommand"="cmd.exe /c takeown /f \\"%1\\" /r /dy & & icacls \\ "% 1 \\ " /grant administrators: F /t "