none
Can you Limit Administrative Access to SteadyState and WDP? RRS feed

  • Question

  • Background Scenaro:

    I have 2 Administrator accounts on the system.  The 1st one was the one used to install SteadyState.  The 2nd one would be used as the main account for doing things such as installing software used only for that instance of Windows.  When it reboots, all changes would disappear and any software would need to be reinstalled - just the way that SteadyState is supposed to work.  the 2nd Admin account would never need to make changes permanently to the disk.

     

    My question:

    Do all Administrative accounts have access to commit changes upon reboot and/or have the ability to turn WDP on and off?  I would like the 2nd account to have access to everything except for stuff that specifically has to do with SteadyState.  Is it possible for 1 Admin account to have access to SteadyState settings but another Admin account to not have access?

     

    Note: I understand the risks of having Administrative access, but i'm not sure I can accomplish being able to install programs temporarily with a limited user profile (thats a different issue altogether).
    Wednesday, October 10, 2007 6:00 PM

Answers

  • Hi Road,

     

    Your understanding is correct. By default, all administrator accounts have privilege to manage SteadyState restrictions and WDP. 

     

    The Block Programs feature can be used to prevent the second user from accessing SteadyState: 

    ----------------------

    1. Log on with your first administrator. Open SteadyState -> User Setting, click the second user account.

    2. Configure WDP and select “Don not warn the administrator about losing changes before log off, restart, or shut down.”

    3. Under Block Programs, click Brower to locate SteadyState program: C:\Program Files\Windows SteadyState\SCTUI.exe. Click Block to add it to the block list.

     

    Please understand that as this restriction was configured through registry changes. An experienced user may restore the changes through Registry Editor. If so, you may consider the following restriction:

     

    4. Under Windows Restrictions -> General Restrictions, select the check box before “Prevent access to the registry editor”

     

    Best Regards,

    Friday, October 12, 2007 8:00 AM

All replies

  • I missed this post when I wrote mine this morning. All Admin accounts on a PC have access to Steady State. I would like to restrict the access to Steady State to Domain Admins, as our PCs are used in a domain Environment. Here is my thread for reference: 

     

    http://forums.microsoft.com/WindowsToolsandUtilities/ShowPost.aspx?PostID=2256719&SiteID=69

     

    You should state here if you are using XP Home or Pro and if you are in a Domain or not, as this could influence the answers that you get. I have seen a couple of posts referring to XP Home Edition which has a built in Admin account which you can access via Safe Mode. Search for "Safe Mode" and you should find them...

     

    Ciao, Steady_Ed

     

    Thursday, October 11, 2007 10:32 AM
  • The computers I am using it on is just Workgroup based - non Domain with XP Home.

     

    Perhaps at this point I am out of luck - especially with XP Home on the laptops.

     

    I'm eager to see how things work with SteadyState 2.5 for Vista.

    Friday, October 12, 2007 4:21 AM
  • Hi Road,

     

    Your understanding is correct. By default, all administrator accounts have privilege to manage SteadyState restrictions and WDP. 

     

    The Block Programs feature can be used to prevent the second user from accessing SteadyState: 

    ----------------------

    1. Log on with your first administrator. Open SteadyState -> User Setting, click the second user account.

    2. Configure WDP and select “Don not warn the administrator about losing changes before log off, restart, or shut down.”

    3. Under Block Programs, click Brower to locate SteadyState program: C:\Program Files\Windows SteadyState\SCTUI.exe. Click Block to add it to the block list.

     

    Please understand that as this restriction was configured through registry changes. An experienced user may restore the changes through Registry Editor. If so, you may consider the following restriction:

     

    4. Under Windows Restrictions -> General Restrictions, select the check box before “Prevent access to the registry editor”

     

    Best Regards,

    Friday, October 12, 2007 8:00 AM