User management, newbie here!

hare05

I'm trying to restrict individual users to the use of particular partitions on my PC (As my brother likes to bittorrent useless things).

I've set up a 30Gb partition with his name on it, and I intend to restrict his access to only that partition. I'm going to move his documents folder across too.

He'll have access to read the other folders and execute files, but no modifying. I'm not so cruel as to restrict him THAT much
My question is this:

If I create a new user group with him as the only user, and then restrict that group's access to specific files / folders, will I have to remove him from User group, etc to prevent him from picking up extra permissions or is there a way to lock him in without screwing with User?

Also, I see another group called authenticated user which I cannot change the permissions of, and I can't see the user list of. Would he be a member of this group too?

Thanks

Win 7 Pro, don't simplify things, just gimme all the dirty details. Google proves useless yet again.

I'm gonna stick this in here as I assume systems managers know what they're doing when it comes to this ^^

rolion

For 150e you can get a PC on adverts and let him be the king of his own castle ! !

hare05

He has a laptop. He messed it up, filled it with sh*te, and now wants to do the same to mine. He's already broken a ton of my headphones / speakers (approx 170 worth), and I'm trying to lock down access to my files through non-admin accounts before I ban him from using the PC (As no doubt he will try something when I go to work).

I also used to have the router locked down properly, but he argued his way into getting the password through the parents (He's 18 and still does that lol). No password on it now, and a basic as f*ck WPA key. He screwed it up so bad I had to reset, and he chose the new wireless key

So, what I'm left with is my PC being the one he wans to use, my files kept in partitions rather than on the C: drive (As he's screwed up windows on me before, lost everything). But even if I lock out access to those partitions, he can still fill my 40GB C: drive with crap and then bitch if I try to delete it, so I made him a partition and moved his docs over. He gets 30GB and can bitch all he wants when its filled.

Is there a way to prevent him from creating / pasting anything on the C: drive?

Still gotta lock down access through my dad's account and the guest account though, which is why I'm here lol.

Basically, if he does something physical there'll be evidence I can show the parents. (like kick in the side window... again. He even bitched at the parents when they offered to buy me a new case. Apparently they didn't buy him a new xbox when he broke it, so.... whatever. Logic does not apply.) If he decides to try deleting system files... No evidence that the parents will understand. Well... Let's not let it happen :rolleyes:

I'm already spending a good chunk of my paychecks on 'upkeep' (read: replacement) of anything he touches. Even if he had a job, he'd never pay for the damage...

And yes, he exists. This is NOT made up.

rfrederick

Honestly I'd not let your brother use your hardware. I'd put my foot down as the older brother and attempt to instill some sense of personal responsibility into him.

hare05

Problem is he's not afraid to turn any little disagreement into a screaming match in front of the parents, and I don't want to put them through that... again *sigh*

Whatever, enough about that and back on topic please.

Do user accounts inherit rights from all groups they are a member of, or can groups specific to them be created to restrict the one account, thus avoiding having to change all the other groups? Or will I have to remove all rights from all groups and then add them individually to each account?

funk-you

Moved to Windows.

-Funk

JonathanAnon

I'd agree with the lads above. Given that he has already damaged some of your own gear, and messed up his laptop, I dont see why you should have to let him use your computer. Seems like no matter what user account setting you put in, he will find some way to break it anyway...

Why dont you help him get his laptop fixed, so that he will fupp off and leave your stuff alone. Sounds like, from what you describe, that he has filled the laptop with viruses / spyware. You could either remove these or simply reinstall the laptop (just make sure you have the required disc(s) before starting this)

Fysh

Things you'll be wanting to do on a general level:

• Restrict his account to "user" level (he'll be part of authenticated users as part of this)
• Modify your BIOS to prevent booting from anything other than the hard drive
• Set a decent password on the BIOS
• Physically lock the case on your machine to prevent easy access to the board for CMOS resets

Within Windows 7 itself, I know that SteadyState let you restrict access to partitions - but from what I've seen it's not compatible with Win7. Guest Mode is supposed to present similar functions, but I'm not sure if it's been properly released or works for what you need.

qwertz

Took me five seconds to find this:

http://windows.microsoft.com/en-US/windows7/products/features/parental-controls

http://www.howtogeek.com/howto/6317/block-users-from-using-certain-applications-with-applocker/

Fysh

qwertz wrote: »

Took me five seconds to find this:

http://windows.microsoft.com/en-US/windows7/products/features/parental-controls

http://www.howtogeek.com/howto/6317/block-users-from-using-certain-applications-with-applocker/

The Parental Controls might be of use, but Applocker is only in Enterprise & Ultimate editions, and the OP's using Pro.

On a separate note: OP, you're dealing with a classic case of PEBKAC here. You need to sort that out (or divest yourself of the issue by banning him from your computer, whichever works). I would suggest:

• Offering to help him sort out his laptop to get it up and running
• Making a list of useful hints on how to avoid recurrence of whatever problem has rendered it unusable
• Discussing the importance of network security on routers, whether or not he pays any attention
• Talking privately to your folks about it, to try and get their support. (Having done the previous steps beforehand helps you hugely here).

When you're talking to them, you have to get two things across:
1) You're happy to help him sort out whatever problems he's got with his laptop, and
2) You don't want him to break your computer instead of fixing his computer.

I assume the broadband is paid by your parents? If so, getting them onboard is vital. Explain in basic terms why having some sort of router security is important. Explain that your brother seems unaware of the risks he's taking with his computer - both the malware risk that he seems to have fallen foul of, and the potential legal risk that torrenting pirated material may expose your parents to. If you really want to lay it on thick you could look for some basic networking best practice documents and computer management best practice docs, though that might be overkill. I'm sure Eircome must have some pages or documentation aimed at parents to make sure the kids are behaving when they're online - might be worth finding them and seeing if there's anything there to help you.

The crux of the matter is to show that you are being considerate and measured in your actions, and that you're coming up with an alternative solution that should make everyone happy. Your brother can scream and act the prat all he wants, but if you play your cards right all this will do is reinforce the difference between your mature and methodical approach and his childish nonsense.

komodosp

Maybe this should be in the Relationships forum or something instead of this one, but at a technical level, why not just tell him to reformat his own laptop?

hare05

Why not format/reinstall his laptop? Because the breakage was PHYSICAL, not a virus (though he had them too). Keyboard keys not working, camera damaged, etc.

Why not just ban him from using the pc? I'm not always in the house, even when I am, he doesn't care, and I have no lock on the door (broken as well, won't go into that any further).
I think he just uses my pc as he doesn't feel the need to be careful when using it. After all, he doesn't feel the need to clean up, and I always end up having to pay for the fixes eventually, out of my own necessities. Can't leave it broke to prove a point when I have college programming projects to finish.

I've explained the router issues to the parents, they seem to think that less arguments in the house is a fair trade for wireless security. Lucky they don't bank online, but now I can't either.
As for bringing them into the discussion... they've already noted that he won't budge on any issue, while I will to save them any grief. When they come into it, it starts with shouting and ends with me making yet another sacrifice in the name of 'peace'. He gets what he wants or things get broken. By everyone.

Ok, so I've played around with the accounts / groups manager and I've managed to restrict him to read/execute only on every drive except C: drive. Is there a way to limit his use of the Documents folders so that he doesn't just fill the C: drive? Can I set a space usage cap or something?

phill106

change the bios settings of pc so that it wont boot. Tell brother and parents its broken.
Parents buy new pc when brother has hissy fit. Fix yours once that happens.
Problem solved.

Fysh

phill106 wrote: »

change the bios settings of pc so that it wont boot. Tell brother and parents its broken.
Parents buy new pc when brother has hissy fit. Fix yours once that happens.
Problem solved.

Normally I wouldn't consider that a fix, but given the horrendous politics that seem to be involved, it's not a bad idea at all...