How Do I Allow A Standard User to Install Programs?
YES!!! I did it!!! Here is what I did:
- Click
Start
and typecmd
. Whencmd.exe
shows up, right-click and selectRun as Administrator
(this allows you to run Command Prompt at an elevated level). - Type
net localgroup Power Users /add /comment:"Standard User with ability to install programs."
and hit enter. - Now you need to assign user/group rights. Download
ntrights.exe
from here. These are the instructions from sevenforums:
A) Open the downloaded .zip file, and extract (drag and drop) the ntrights.exe file to your desktop.
B) Right click on the ntrights.exe file, click on Properties, General tab, and click on the Unblock button if available. NOTE: If you do not have a Unblock button under the General tab, then the file is already unblocked and you can continue on to step 1C.
C) Right click on the ntrights.exe file and click on Move.
D) Open Windows Explorer and navigate to and open the C:\Windows\System32 folder, then Paste the ntrights.exe file to move it here.
E) If prompted, click on Continue and Yes to approve moving the ntrights.exe file into the System32 folder, then close the Windows Explorer window.
- In an elevated command prompt (see step 1), type
ntrights -U "Power Users" +R SeNetworkLogonRight
and hit enter. Type in the same thing again, only changeSeNetworkLogonRight
with something else. You can try the following:SeInteractiveLogonRight
SeChangeNotifyPrivilege
SeSystemtimePrivilege
SeTimeZonePrivilege
SeCreatePagefilePrivilege
SeCreateGlobalPrivilege
SeCreatePermanentPrivilege
SeIncreaseWorkingSetPrivilege
SeIncreaseBasePriorityPrivilege
SeLoadDriverPrivilege
SeSystemEnvironmentPrivilege
SeManageVolumePrivilege
SeProfileSingleProcessPrivilege
SeSystemProfilePrivilege
SeShutdownPrivilege
For a complete list of User Rights and explanations, see my comment below (I can't post more than two links; if someone wants to edit this to add the link, please feel free).
- Once that is complete, you then need to give your new "Power Users" group permission to write to the C drive. Open my computer, right click on the C drive, and go to
Properties
. Click on theSecurity
tab. Click onEdit...
thenAdd...
and in the big box underEnter the object names to select
typePower Users
and clickCheck Names
and clickOK
. - Under the heading
Group or User Names
, you will see "Power Users." Click on it, and click on the checkmark besideFull Control
. It should automatically check off everything else, but if not, manually check everything else. The only thing that you can't check because it is grayed out isSpecial Permissions
. Click Apply, and it will give your group permissions. Ignore any errors that come up and continue anyway (I think assigning group rights in step 4 took care if this).
7.Open an elevated command prompt again (step 1), and type net localgroup "Users" "Power Users" /ADD
This nests your Power Users Group within Users so that way it is basically a Standard User account, but with additional privileges.
- Type
net localgroup "Power Users" user_000 /ADD
(user_000 being the user name for the account you are trying to keep as a Standard User and allow to install programs). This will still keep your user in the Users group, but will also add the user to the new Power Users group (so it is part of multiple groups). Note: If your user is signed in with a Microsoft Passport, you can find out your username by clicking onStart
and typingcontrol userpasswords2
and hitting enter. Then click on the user account you need to find the name for, and clickProperties
and you'll see your actual user name.
ALL DONE! And you will notice that Family Safety is still enforced, yet the user can't change its settings or give additional time or unblock websites or whatever. Nor can the user add another user with the User Accounts feature. Yet the user can install programs. :)