windows 8.1 - How Do I Allow A Standard User to Install Programs?

Yes, I realize that defeats the purpose of standard user. But here is the situation. A friend of mine wants to set up time limits for his home schooled son, and his son needs to be a standard user in order to use Family Safety. But at the same time, his son (who I personally think is way too old to have time limits), needs to be able to update and install some of his games on his computer. So I guess it's just sort of "light" parental control (just something to help him focus and not get distracted with hours of gaming).

It is the basic version of Windows 8.1, so there is no Group Policy editor (gpedit.msc). However, I'm fairly good with computers and I figured out how to install it. But it doesn't have a lot of the features that the "real" gpedit seems to have. Here is an example of what is in my gpedit:

Answer

YES!!! I did it!!! Here is what I did:

1. Click Start and type cmd. When cmd.exe shows up, right-click and select Run as Administrator (this allows you to run Command Prompt at an elevated level).


2. Type net localgroup Power Users /add /comment:"Standard User with ability to install programs." and hit enter.


3. Now you need to assign user/group rights. Download ntrights.exe from here. These are the instructions from sevenforums:

A) Open the downloaded .zip file, and extract (drag and drop) the ntrights.exe file to your desktop.

B) Right click on the ntrights.exe file, click on Properties, General tab, and click on the Unblock button if available. NOTE: If you do not have a Unblock button under the General tab, then the file is already unblocked and you can continue on to step 1C.

C) Right click on the ntrights.exe file and click on Move.

D) Open Windows Explorer and navigate to and open the C:\Windows\System32 folder, then Paste the ntrights.exe file to move it here.

E) If prompted, click on Continue and Yes to approve moving the ntrights.exe file into the System32 folder, then close the Windows Explorer window.

4. In an elevated command prompt (see step 1), type ntrights -U "Power Users" +R SeNetworkLogonRight and hit enter. Type in the same thing again, only change SeNetworkLogonRightwith something else. You can try the following:
   
   
   
   • SeInteractiveLogonRight
   
   
   • SeChangeNotifyPrivilege
   
   
   • SeSystemtimePrivilege
   
   
   • SeTimeZonePrivilege
   
   
   • SeCreatePagefilePrivilege
   
   
   • SeCreateGlobalPrivilege
   
   
   • SeCreatePermanentPrivilege
   
   
   • SeIncreaseWorkingSetPrivilege
   
   
   • SeIncreaseBasePriorityPrivilege
   
   
   • SeLoadDriverPrivilege
   
   
   • SeSystemEnvironmentPrivilege
   
   
   • SeManageVolumePrivilege
   
   
   • SeProfileSingleProcessPrivilege
   
   
   • SeSystemProfilePrivilege
   
   
   • SeShutdownPrivilege
   
   
   
   

For a complete list of User Rights and explanations, see my comment below (I can't post more than two links; if someone wants to edit this to add the link, please feel free).

5. Once that is complete, you then need to give your new "Power Users" group permission to write to the C drive. Open my computer, right click on the C drive, and go to Properties. Click on the Security tab. Click on Edit... then Add... and in the big box under Enter the object names to select type Power Users and click Check Names and click OK.


6. Under the heading Group or User Names, you will see "Power Users." Click on it, and click on the checkmark beside Full Control. It should automatically check off everything else, but if not, manually check everything else. The only thing that you can't check because it is grayed out is Special Permissions. Click Apply, and it will give your group permissions. Ignore any errors that come up and continue anyway (I think assigning group rights in step 4 took care if this).

7.Open an elevated command prompt again (step 1), and type net localgroup "Users" "Power Users" /ADD This nests your Power Users Group within Users so that way it is basically a Standard User account, but with additional privileges.

8. Type net localgroup "Power Users" user_000 /ADD(user_000 being the user name for the account you are trying to keep as a Standard User and allow to install programs). This will still keep your user in the Users group, but will also add the user to the new Power Users group (so it is part of multiple groups). Note: If your user is signed in with a Microsoft Passport, you can find out your username by clicking on Startand typing control userpasswords2 and hitting enter. Then click on the user account you need to find the name for, and click Propertiesand you'll see your actual user name.

ALL DONE! And you will notice that Family Safety is still enforced, yet the user can't change its settings or give additional time or unblock websites or whatever. Nor can the user add another user with the User Accounts feature. Yet the user can install programs. :)