Little-known "Windows 2000/XP Restricted" issue

As you know, in Windows 2000/XP, if you are an administrator, you can change your password with the Net User account password even if you don't know the password of another user (administrator). It is said that the MS is for the convenience of the user (such as the user forgetting the password), in addition, the user can also use the Net Localgroup Administrators account /add command to add the account to the administrator group.

However, if you are not an administrator, such as a Guest account, you can't use the above command on the surface, but we can use it through some channel.

Example: Create an administrator as a Guest account

1. Create a batch file with the following contents:

net user admin /add
net localgroup administrators Admin /add

Save the above batch file as admin.bat.

Note: The above batch file function is to create an administrator account named admin (the password is blank).

Second, use this batch file as the boot script for Windows.

1. In the Run dialog box, type gpedit.msc

2. Locate the Computer Configuration 1 > Windows Settings 1 > Script (Start/Shutdown), double-click the start of the right window. Add the previously created admin.bat to it.

3, restart the computer, the system will have an administrator named admin

The above operation is feasible in Windows 2000/XP, but to ensure that the account can access the registry, group policy (The operation of creating an account is actually adding the corresponding items and values ​​in the registry), and the default Guest/restricted account in Windows does not have this restriction.

Perhaps, we don't need to use the Guest account to create an administrator, but imagine that if a program is only executable by the administrator, can it be implemented in the above way?

Summary: Windows system defaults to Guest/Restricted Accounts are only superficial. As an experienced system administrator, there are still many things to do. At least, restricted users should be prohibited from accessing/editing registrations. Table, group policy, etc.