The following guide explains how to configure those user accounts for optimal system security, and while it does so with Windows 7 in mind, it can be easily applied to previous Windows OS’ as well.

It may not sound that bad to have additional user accounts configured on the system. The secure way however is to either deactivate accounts that are not needed, or password protect them so that no one without proper authorization can log in using one of those accounts.

Probably the easiest way to do that is to use the Local Users And Groups Policy. It can be opened with the shortcut Windows-R, typing lusrmgr.msc and hitting enter.

Please note that this control panel is only available in Windows Professional, Ultimate and Enterprise and not Basic, Starter or Home editions.

Once loaded it displays the two items Users and Groups in the left sidebar. A click on users displays all users of the operating system.

windows7 users lusrmgrmsc

A double-click on an entry opens a properties menu for the selected user. Here it is possible to disable the account. It is recommended to disable the guest account in Windows 7, as it is usually not used at all.

disable windows7 guest account

Checking the “Account is disabled” box and clicking on Ok will disable the account, so that no one can use it to log in.

The Administrator account is the second account that gets automatically created during installation. It is disabled by default, and a double-click can be used to verify that.

A right-click on a user account opens a context menu with options to set passwords for each account. It is a good security practice to set secure passwords for all accounts, even the disabled ones. The password should have a length of at least 16 chars, and consist of numbers, letters and special chars.

As mentioned previously, Windows 7 Home, Starter and Basic owners do not have access to the configuration panel. Their option is to open the Control Panel from the Windows Start Menu, and there the User Accounts panel.

Information about the current account are displayed, plus an option to Manage another account.

manage another account

Please note that only the guest account is displayed along the user accounts of the operating system. A click on the Guest account displays options to change the picture of the account, and to turn the guest account off.

Now that the guest account has been disabled, it is time to do the same for the Administrator account. For that you need to open an elevated command prompt. Do that by clicking on the Start Menu orb, then All Programs, Accessories, right-click the Command Prompt link and select Run as administrator.

Now enter the following command to disable the Windows 7 Administrator account:

net user administrator /active:no

To change a password for a user account type

net user username password

with username being the name of the account, and password the new password.

Accounts Tuner has been designed to provide administrators with a tool to quickly change user related settings. The free program can be used by administrators to change security settings of local and remote users.

These settings are all available in the local or group security policy, but those settings are harder to reach, and not available on all supported operating systems. Especially Windows Home users do not have access to the policy tools.

Accounts Tuner displays all information in its main interface on startup. The username pull down menu can be used to select the information of a specific local user, the server option allows to connect to a server to manage the user accounts of that server as well, but only if it is connected to the local network.

accounts tuner

The settings that can be changed are divided into user parameters on the left side, and server parameters on the right.

User parameters include the following options:

• Account Disabled: Check or uncheck to disable or enable a specific user account in Windows.
• Account Locked: User accounts are temporarily locked after a specific amount of failed login attempts. Allows to unlock accounts, or lock them.
• Password Expired: Is checked if the user password has expired.
• Password Required: If enabled, forces the user to log in with the account password, if disabled, allows log ins without password.
• Password never expires: Sets the password age to unlimited, so that the password does not have to be changed after x days.
• User can change password: Allows users to change their passwords, if disabled prevents that and only allows admins to change the pass of the user.

Server parameters:

• Maximal Password Age: The maximum time a user is allowed to use the same password, before it is required to be changed.
• Minimal Password Age: Users can only change the password of the account after the time specified in this field.
• Minimal Password Length: Defines a password length minimum, passwords shorter than the number will not be accepted.
• Bad Passwords Before Lockout: Defines the number of failed logon attempts before the account will be locked by the system.
• Lockout Duration: Defines the time the account stays locked. Will unlock automatically after the time passes.
• Bad Password Timeout: The interval between failed logon attempts in which failed logon attempts are not counted.
• Password History Length: Compares the new password with passwords used in the past. Prevents the creation of to-similar passwords.
• Password Expiry Warning: Defines a “warning” period in which the user is reminded that the password needs to be changed soon.

Accounts Tuner offers fast access to user account security settings. The program is especially helpful for users of systems without Group Policy Editors, the ease of access however makes it an excellent choice for system with the editor as well.

Accounts Tuner may be used on computers with following operating systems: Microsoft Windows NT 4.0 (Service Pack 6 required), Windows 2000, Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2 and later. Both 32- and 64-bit systems supported. Administrator rights required for the program to work.

The program is available for download at the developer’s website over at SMSoft.ru. (via Nirmal TV)

This can be all done from the command line without lots of effort if the commands to do that are known. User Management is a software program that has been designed for system administrators who do not want to use the command line for managing user accounts.

The program can be used to display all user accounts of a local computer system. It will list the name of the account, the status and display comments if available.

The program supports local computer systems only with the option to enter a user name and password to log into remote computer systems if necessary.

A user account can be selected in the list of available users. The program provides two buttons to work with the selected user. It is possible to disable or enable an account. Disabled accounts are indicated with a red x next to the user icon.

The second option is to reset a password of the selected user. Doing so will display a new dialog window where a new password for the selected account can be entered.

User Management is a straightforward tool for administrators who prefer to use a graphical user interface to manage user accounts. It can be downloaded from download portals such as Sofotex as the download on the developer’s website does not seem to work right now.

Carroll is a small software program that offers a solution to this problem. The software is installed for all users allowing each to set their own screen resolution in the operating system. The computer program will display a list of available screen resolutions to the user upon startup. Selecting a screen resolution and clicking on the link “Change screen resolution and restore with every logon” will assign that screen resolution to the user. This will also be the screen resolution of all other users unless they specify a different screen resolution in the program.

This can be easily done as Carroll is installed for all users. Carroll needs to be autostarted with Windows if a custom screen resolution has been specified by a user. It will basically switch to the custom screen resolution upon startup.

Carroll is a small Windows software program that is available at the developer’s website.

All you need to do to find out the amount of existing user accounts is to open the command line in Windows and type the following command netsh dump > netsh.txt. Open that text document in a text editor and scroll down to the section entitled ‘Ras Configuration’.

You will most likely find the following user accounts listed there:

set user name = Administrator dialin = policy cbpolicy = none
set user name = Guest dialin = policy cbpolicy = none
set user name = HelpAssistant dialin = policy cbpolicy = none
set user name = SUPPORT_388945a0 dialin = policy cbpolicy = none

Plus the real user account that you are using to login into Windows. The command net user 'username' reveals detailed information about that user account. Just replace ‘username’ with the name of the account that you want to get information for.

net user Administrator is a built-in account for administering the computer/domain
net user Guest a built-in account for guest access to the computer/domain
net user HelpAssistant is a Remote Desktop Help Assistant Account.
net user SUPPORT_388945a0 is a This is a vendor’s account for the Help and Support Service.

I do not need those accounts. Maybe the administrator account could come in handy if I can’t login into Windows anymore with my normal user account but all the other accounts are a security risk and not needed at all. I therefor made the decision to remove the HelpAssistant and Support_388945a0 account and password protect the Administrator and Guest account.

The reason why I keep the Administrator and Guest account is not a choice of mine. It is simply not possible to delete those accounts. The next best thing is to password protect them properly.

You delete a user account in Windows using the following command: net user 'username' /delete. This would mean that I would write net user Guest /delete to delete the guest account.

Changing the password is as easy. To do that use the command: net user 'username' 'password. If I wanted to change the password of the Administrators account to ghacks I would use the command net user Administrator ghacks