Admin Tips
- Windows Server 2008/2003/2000/XP/NT Administrator Knowledge Base
  - Windows 2003
    - Admin Tips
      - Miscellaneous
        Preventing Users from Creating Local User Accounts

Section(s): Miscellaneous
Published on Dec 14, 2006.
Last Modified on Dec 14, 2006.
Last Modified by Chris Sanders.
Rated 3.9 out of 5 based on 8 votes.

By default, any user on computer can create a local user account. Let’s fix that.

In Windows 2000 or XP any user who logs on to a computer has rights to create a basic local user account on that machine. Although these created users will only be in the users group and not power users or administrators of the machine, this is still something that should not be happening on a regular basis as it can create security loopholes in your workstations.

To remedy this situation you can right click on my computer, select manage, and browse to the groups section under the local users and groups heading. Double clicking the users group should display all of its members. You will notice in this group that NT AUTORITY/INTERACTIVE is a member. Selecting this account and clicking remove will remove it from the group and prevent users from creating other local user accounts.

***

Chris Sanders is the network administrator for one of the largest public school systems in the state of Kentucky. Chris's specialties include general network administration, windows server 2003, wireless networking, and security. You can view Chris' personal website at www.chrissanders.org.

About Chris Sanders

Chris Sanders is a network security analyst for EWA Government Systems Inc. Chris is the author of the book Practical Packet Analysis as well as several technical articles. His personal website at www.chrissanders.org contains a great deal of information, articles, and guides related to network administration, network security, packet analysis, and general information technology.