Windows 10: Is it possible to create two administrative user profiles?

*SORRY--just realized this should be in another forum. Not sure how to move but checking with admin now.

I would like to create two administrator user profiles, one with complete control and one configured with (at least) two limitations:

1) the inability to move, delete, or otherwise modify executables (or other files, as needed); plan on doing that through making the primary administrator control a given file, and then assigning lesser rights to the secondary administrator.

2) the inability to enter safe mode, modify the registry, or change the time.

I want to give the primary administrator complete rights, so if something happens backup etc. is accessible.

1) First, need to know if it is possible (and won't screw up my system).

2) If it is, can this be done safely, and through group policy?

3) Also, can both users share the same programs, file settings, etc.?

I currrently have Win 10 x64 Home, but am planning to upgrade (the free, fully functional--but nagging) Win 10 Pro to use group policy--it has it, right?

I read that older versions of Windows allowed you to create a "superuser" profile with advanced properties; if I can't do this in Windows 10, would it be advisable to go back to Win 8 (or whatever version supported that feature)?

Thank you!

:)

 

is it possible to create multiple calendar profiles to keep from sync'ing personal appointments to exchange work server?

This is deliberate, although with Windows Phone 7 this path is abandoned. The idea is that Exchange should always have a good overview over the availability of people. It makes sure that there are no scheduling conflicts between (private) appointments. You
can keep your appointments private by selecting the "private" option. This will block access to the appointment but it will allow it to block the time for other appointments. When granting access to delegates, it is an explicit option to allow access to private
appointments, which is disabled by default.

Jaap

Owner Dutch Windows Mobile Wiki

 

is it possible to create multiple calendar profiles to keep from sync'ing personal appointments to exchange work server?

Unfortunate, You can only sync one specific calendar on with your active sync on the Windows Phone 6.5. Not even multiple calendars on one exchange account.



The new Windows Phone 7 will allow you sync from multiple exchange accounts like (corporate, Live and google exchange)

, Microsoft MVP- Windows Phone

| http://www.MobilityMinded.com |

Moderator Microsoft Windows Phone Answers |

 

You can't stop a user from entering safe mode. That selection for safe mode happens before the OS even starts (and thus the user even logs in).

Most other things can be done through group policy, but it's a tedious task making the OS hardened like that. And requires a lot of research on your part.

 

By design, all Administrator accounts are equal. That has been the case all the way back to the first release of NT in 1993. There is no such thing as primary and secondary administrator accounts. Whatever restrictions you might impose any other administrator can remove or modify. That is an inherent property of an administrator account and cannot be removed.

 

Yep, I figured it would take a lot of work. Given that I have just like 3 things to tweak, can I start with an administrator profile and scale down (that is, retain the settings other than those three or so I want to keep)? Relatively computer savvy, but never used group policy. But have dl'd Microsoft's spreadsheet with all of the commands.

Should I just start with the default administrator account and then create another administrator account (and if so, local or MS)? If two administrators, how do I specify which is default?

I have found a command line that works 100% for locking safe mode. I think it is "bcdedit" something, but can't remember. It works so long as you don't have a recovery environment. Which might not be the most optimal environment. Can a user with restricted security settings (such as described above) delete etc. in safe mode, or is that not a concern?

Thank you!

 

Even when you are 1) working as the primary administrator and 2) modify the permissions of the second administrator? Would you just have to create a low level profile and "scale up" with additional privileges?

 

A "primary administrator" may remove the rights of a "secondary administrator" but the latter can always take them back. Any rights an administrator does not have he can grant himself. That is an inherent capability of an administrator account.

 

That's actually not exactly true.

There is the Local Administrator, then there are accounts added to the Administrators group. A third kind of administrator (not really an admin, but has admin abilities) is often termed "Power User". You can also create accounts that are manually given various permissions (such as installing software) without making them an actual administrator.

That is what I meant by it being a lot of work, since you're going to have to start with a standard account and add abilities.

 

No. You have to start with a standard user and add the permissions you want them to have. Adding a user to the Administrators group gives them full rights to everything, and while you can deny any particular user (even administrators) access to certain things, being an administrator means they could just give themselves access to it again.