Overclock.net › Forums › Software, Programming and Coding › Operating Systems › Windows › Change account from Admin to Standard using PowerShell or Group Policy?
New Posts  All Forums:Forum Nav:

Change account from Admin to Standard using PowerShell or Group Policy?

post #1 of 3
Thread Starter 
Hey guys, so I've got an interesting question.

I just finished redoing (fresh install and some upgrades) the PC my family uses as some parts were failing and it was bogged down with garbage that had been installed on it. It is now running Windows 8 Professional.

One of the accounts on the PC is for my younger 10 year old brother, who was the source of most of the garbage that ended up on the PC. I have since changed his account from Administrator to Standard, but he does not like this because he can't install anything (which is the goal). Unfortunately, next to me, he knows how to use the computer the best. Much better than our mother who holds the only administrator account currently. He is spoiled and does not take no for an answer. At any opportunity he gets, if his mom leaves the PC unattended, he will not hesitate to quickly jump in and change his account to an Administrator.

I am going back to school in a few days and won't be able to change it back if he does, and nobody else will ever know he did it.

So I would like to know if there is any way I can set something up, perhaps using Group Policy or a PowerShell script that will check his account status periodically (like every time the computer turns on or every time our mom logs into her admin account, for example) and if it is set to Administrator, it will automatically (and silently) change it to Standard. If it is Standard, it just won't do anything.

If this is possible to do using either Group Policy or a PowerShell script, or any other way, I would very much appreciate any help in getting it set up. Thanks! smile.gif
Cool'n'Quiet
(9 items)
 
  
CPUMotherboardGraphicsRAM
Core i7-3770T Gigabyte GA-Z77X-UD4H GeForce GT 640 (fanless) Mushkin 2x 8GB DDR3 1600 CL8 
Hard DriveCoolingOSPower
Samsung 256GB 840 Pro SSD Noctua NH-U9B SE2 Linux Mint Debian Edition 201303 64-bit SeaSonic 400W 80+Platinum (fanless) 
Case
Corsair Obsidian 550D 
  hide details  
Reply
Cool'n'Quiet
(9 items)
 
  
CPUMotherboardGraphicsRAM
Core i7-3770T Gigabyte GA-Z77X-UD4H GeForce GT 640 (fanless) Mushkin 2x 8GB DDR3 1600 CL8 
Hard DriveCoolingOSPower
Samsung 256GB 840 Pro SSD Noctua NH-U9B SE2 Linux Mint Debian Edition 201303 64-bit SeaSonic 400W 80+Platinum (fanless) 
Case
Corsair Obsidian 550D 
  hide details  
Reply
post #2 of 3
Quote:
Originally Posted by W4nderer View Post

Hey guys, so I've got an interesting question.

I just finished redoing (fresh install and some upgrades) the PC my family uses as some parts were failing and it was bogged down with garbage that had been installed on it. It is now running Windows 8 Professional.

One of the accounts on the PC is for my younger 10 year old brother, who was the source of most of the garbage that ended up on the PC. I have since changed his account from Administrator to Standard, but he does not like this because he can't install anything (which is the goal). Unfortunately, next to me, he knows how to use the computer the best. Much better than our mother who holds the only administrator account currently. He is spoiled and does not take no for an answer. At any opportunity he gets, if his mom leaves the PC unattended, he will not hesitate to quickly jump in and change his account to an Administrator.

I am going back to school in a few days and won't be able to change it back if he does, and nobody else will ever know he did it.

So I would like to know if there is any way I can set something up, perhaps using Group Policy or a PowerShell script that will check his account status periodically (like every time the computer turns on or every time our mom logs into her admin account, for example) and if it is set to Administrator, it will automatically (and silently) change it to Standard. If it is Standard, it just won't do anything.

If this is possible to do using either Group Policy or a PowerShell script, or any other way, I would very much appreciate any help in getting it set up. Thanks! smile.gif

I will look, I doubt there is a way though.

In any case:

1. Educate your mother to lock the PC.
2. Enforce the screen saver to enable after 1 minute and require password to resume to account for cases where she doesn't lock the PC.
3. Ensure a strong password on the administrator account so he cannot try to guess it.
4. Enable account lockout policies to mitigate attempts to guess administrative passwords.
5. Ensure the built-in administrator account is disabled.
6. Enable admin approval mode for ALL administrators (enforce UAC).
7. If your mom can't be trusted to protect her privileges, take them away.

You can also block access to the user accounts section of the Control Panel. But remember no blocking or changing of account privilege will be foolproof because once he has administrative access, anything can be done. So you really need to just get your mom to lock the damn PC when she leaves it unattended.
Ol' Sandy
(28 items)
 
"Zeus"
(12 items)
 
Elite Preview
(6 items)
 
CPUMotherboardGraphicsRAM
Intel Xeon E3-1230v3 Gigabyte GA-Z97X-UD5H-BK MSI Gaming GTX 980 Kingston 32GB (4x8) 
Hard DriveHard DriveHard DriveHard Drive
Plextor PX-256M5S 256GB Samsung EVO 1TB Hitachi HDS721010CLA332 Hitachi HDS723020BLA642 
Hard DriveHard DriveHard DriveOptical Drive
Hitachi HDS723020BLA642 Hitachi HUA722010CLA330 WDC WD10EARS-00Z5B1 TSSTcorp CDDVDW SH-S223B 
CoolingCoolingOSMonitor
Phanteks PH-TC14PE with TY-140's Lamptron FCv5 (x2) Windows 8 Pro 64-bit Dell U2412M 
MonitorMonitorMonitorKeyboard
Dell U2412M Dell U2212HM Dell U2713HM Topre Realforce 87UB | Ducky DK9087 G2 Pro 
PowerCaseMouseMouse Pad
Corsair AX-750 Corsair Obsidian 650D Logitech G700 XTRAC Ripper XXL 
AudioAudioAudioAudio
Beyerdynamic DT-770 Pro 250ohm Schiit Bifrost DAC Schiit Asgard 2 HiVi Swan M50W 2.1 
CPUMotherboardRAMHard Drive
Intel Xeon E5-2620 Super Micro X9SRL-F-B 128GB 1333MHz LSI 9271-8i 
OSPowerCase
VMware ESXi 5.5 SeaSonic SS-400FL2 Fractal Define R3 
CPUMotherboardGraphicsRAM
Intel Core i5-3437U HP EliteBook Folio 9470m  Intel HD Graphics 4000  16GB DDR3 SDRAM 
Hard DriveOS
256GB SSD Windows 10 Insider Preview 
  hide details  
Reply
Ol' Sandy
(28 items)
 
"Zeus"
(12 items)
 
Elite Preview
(6 items)
 
CPUMotherboardGraphicsRAM
Intel Xeon E3-1230v3 Gigabyte GA-Z97X-UD5H-BK MSI Gaming GTX 980 Kingston 32GB (4x8) 
Hard DriveHard DriveHard DriveHard Drive
Plextor PX-256M5S 256GB Samsung EVO 1TB Hitachi HDS721010CLA332 Hitachi HDS723020BLA642 
Hard DriveHard DriveHard DriveOptical Drive
Hitachi HDS723020BLA642 Hitachi HUA722010CLA330 WDC WD10EARS-00Z5B1 TSSTcorp CDDVDW SH-S223B 
CoolingCoolingOSMonitor
Phanteks PH-TC14PE with TY-140's Lamptron FCv5 (x2) Windows 8 Pro 64-bit Dell U2412M 
MonitorMonitorMonitorKeyboard
Dell U2412M Dell U2212HM Dell U2713HM Topre Realforce 87UB | Ducky DK9087 G2 Pro 
PowerCaseMouseMouse Pad
Corsair AX-750 Corsair Obsidian 650D Logitech G700 XTRAC Ripper XXL 
AudioAudioAudioAudio
Beyerdynamic DT-770 Pro 250ohm Schiit Bifrost DAC Schiit Asgard 2 HiVi Swan M50W 2.1 
CPUMotherboardRAMHard Drive
Intel Xeon E5-2620 Super Micro X9SRL-F-B 128GB 1333MHz LSI 9271-8i 
OSPowerCase
VMware ESXi 5.5 SeaSonic SS-400FL2 Fractal Define R3 
CPUMotherboardGraphicsRAM
Intel Core i5-3437U HP EliteBook Folio 9470m  Intel HD Graphics 4000  16GB DDR3 SDRAM 
Hard DriveOS
256GB SSD Windows 10 Insider Preview 
  hide details  
Reply
post #3 of 3
Thread Starter 
Thanks for the tips. I actually figured out how to remove access to User Accounts using group policy. There is no way he will figure out how to get it back with group policy or even how to access the group policy configuration in the first place (or even to know to look for it).
Cool'n'Quiet
(9 items)
 
  
CPUMotherboardGraphicsRAM
Core i7-3770T Gigabyte GA-Z77X-UD4H GeForce GT 640 (fanless) Mushkin 2x 8GB DDR3 1600 CL8 
Hard DriveCoolingOSPower
Samsung 256GB 840 Pro SSD Noctua NH-U9B SE2 Linux Mint Debian Edition 201303 64-bit SeaSonic 400W 80+Platinum (fanless) 
Case
Corsair Obsidian 550D 
  hide details  
Reply
Cool'n'Quiet
(9 items)
 
  
CPUMotherboardGraphicsRAM
Core i7-3770T Gigabyte GA-Z77X-UD4H GeForce GT 640 (fanless) Mushkin 2x 8GB DDR3 1600 CL8 
Hard DriveCoolingOSPower
Samsung 256GB 840 Pro SSD Noctua NH-U9B SE2 Linux Mint Debian Edition 201303 64-bit SeaSonic 400W 80+Platinum (fanless) 
Case
Corsair Obsidian 550D 
  hide details  
Reply
New Posts  All Forums:Forum Nav:
  Return Home
  Back to Forum: Windows
Overclock.net › Forums › Software, Programming and Coding › Operating Systems › Windows › Change account from Admin to Standard using PowerShell or Group Policy?