Standard User has access to Admin User folder

This is my first time setting up multiple user accounts on one computer, so I don't have direct experience with the restrictions placed on standard user accounts. From what I've read, they aren't supposed to have access to other users' folders. I'm not sure what other access is restricted, so that's a secondary question I have. There's a lot of general information out there, but specifics aren't often discussed.

My main question is why a standard user account on this computer has access to my admin account user folder? It may have something to do with the following process that occurred when setting up this second account:

I created the account as a standard account. I found that I was unable to make certain tweaks to the user experience, so I changed it to an admin account. I made the changes I wanted, then converted it back to a standard account. I then moved most of the standard account's user subfolders to another drive (the same drive where my admin account user subfolders reside). I then discovered that the standard account had access to the admin account user folders (both the original C: drive folder and the one on the other drive). Windows didn't even challenge me with an "are you sure?" like it did when my primary admin account tried to access the other user account.

I realize I can manually change the permissions of specific folders, but I'm curious what happened here. Is this intended behavior? Shouldn't permissions have been revoked when the account was converted back to standard? I would like for the account to behave like it should in terms of this sort of access and all established user account restrictions. I worry that this is an indication that there are other "rules" that have been broken, not just folder permissions.

Edit: I did find this very helpful thread about permissions/restrictions of standard user accounts in Win 11.

I get the feeling that a Local Account was established in addition to the main/Microsoft Account. The Local Account can have either admin privileges or Standard privileges. Either type account with admin privileges can do all the same things. The first User established during Setup is an Administrator, has to at least one so changes, installs, etc., can be made. Also, to avoid file confusion each succeeding User after the first should have a slightly different name by at least one character or files may bet intermingled. Had to reinstall one for that issue, file ownership couldn't be proven, something like Joseph for the main and Joe for the Local.

Manage accounts:

abactuon said:

Sample chapters | Microsoft Press Store

www.microsoftpressstore.com

Click to expand...

Thanks for the link. There's a lot of great information in there! However, it solidifies my question. I had already done what it says to do to revoke administrative permissions (see screenshot), but that account can still access the admin account's User folders.

Both accounts are Local. One is Admin, the other is Standard. Why is the Standard account still able to access other users' folders (especially an admin user's folders)? That's not how this should work, right?

Rangoon said:

Why is the Standard account still able to access other users' folders (especially an admin user's folders)? That's not how this should work, right?

Click to expand...

As an admin user, if you try to access another user's folder you will be challenged. Here I am signed in as 'Owner' (a local admin account) and am trying to access the user folder for 'Maintenance'.



If I click Continue I will be exercising my admin powers to grant my account permanent access to the Maintenance folder. Should I later demote Owner to a standard account it will still be able to access Maintenance, you don't need admin rights once your account has been granted permission. That's probably how your situation arose.

The solution is to look at the security permissions of your user folder. You'll almost certainly find that the standard (that was once an admin) account has full permissions. Just remove their account name from your folder's permissions and you'll be back to normal.

Bree said:

The solution is to look at the security permissions of your user folder. You'll almost certainly find that the standard (that was once an admin) account has full permissions. Just remove their account name from your folder's permissions and you'll be back to normal.

Click to expand...

I'll take a look. I'm sure you're right, and that makes sense if reverting back to a standard doesn't actually revoke previously/specifically granted permissions. I just assumed it would, and worried that there could be other fallout from something that had gone awry. I'll manually set the permissions and then confirm, e.g., that account can't edit the registry or install/uninstall software.

Rangoon said:

that makes sense if reverting back to a standard doesn't actually revoke previously/specifically granted permissions. I just assumed it would, and worried that there could be other fallout from something that had gone awry. I'll manually set the permissions and then confirm, e.g., that account can't edit the registry or install/uninstall software.

Click to expand...

Permissions for folders are assigned on the basis of the SID (security ID) of the account concerned. If an account subsequently tries to access a folder, access is granted (or not) if its SID matches. Whether it's an admin or standard user plays no part in this.

Installing, registry editing, etc. does however checks for the account status each time. If it's an admin user it will be asked if it wants to continue with an OK/NO choice. A standard user will see the same challenge, but it will have the OK button greyed out until the user provides the name and password of an admin account.

11 has introduced some changes, it is best to remove inherited permissions and users, to be able to apply new ones.

TairikuOkami said:

11 has introduced some changes, it is best to remove inherited permissions and users, to be able to apply new ones.

Click to expand...

What sorts of changes? I did to much customizing on the 2nd account to want to delete it and recreate it. The customizing is why I had to change it to an admin account in the first place, then back to standard. They required admin status. Will other unintended things be off about an admin account turned standard?

The issue which @Bree raises in post 5 is explained in this MS article. Continue dialog box for folder access in Windows Explorer when user only has access with elevated token - Windows Server . Workaround #1 can also be done with any third party file manager.

The key message is never click continue!

As regards fixing the permissions you might find SetAcl Studio helpful. SetACL Studio - Free & Intuitive Permission and ACL Management • Helge Klein It enables backup and restore privileges if you run it as an administrator, so you have access to every object's security, So be be very careful.

If you do want to move your user folders, do make sure that you correctly duplicate the permissions in the folders you have chosen.

Rangoon said:

I did to much customizing on the 2nd account to want to delete it and recreate it. The customizing is why I had to change it to an admin account in the first place, then back to standard. They required admin status.

Click to expand...

I'm puzzled by this. If a tweak says it requires admin access, it normally applies to all profiles, so performing the tweak from a different administrative account should affect all accounts. In the tutorials on this site @Brink is very clear about this. If you want different tweaks on different accounts, then you'll have to make appropriate changes in your profile for which a normal user account should be ok. Most tweaks that involve changes to HKCR can be done per user, although the method may be different. Ask if you get stuck.

If a tweak is a User Policy that can be set using Group Policy Editor, you can't apply it to a standard user account using the instructions for direct registry editing, but this shouldn't affect you because you will have Group Policy Editor. There's a workaround for those who only have Windows Home.

Thanks for the insights here! I also was confused that the tweaks on the second account required admin privileges. A friend of mine, who knows much more than I do, was doing the tweaks with me. I'll try to get a few examples that weren't working otherwise. They didn't carry over from when they were performed on my main admin account, but that just gave me an idea. I wonder if we should have gone back and just run those tweaks again my admin account. So, maybe it's best to create the admin, then any standard accounts, then run tweaks on the admin account, followed by user tweaks on the others. Would that make sense?

If so, perhaps I'll just delete the standard account and recreate it anew and it'll never need to become an admin account. That's a much more elegant solution if it works.

Skeptic Mike said:

I'm puzzled by this. If a tweak says it requires admin access, it normally applies to all profiles, so performing the tweak from a different administrative account should affect all accounts.

Click to expand...

There were some user-side tweaks that required editing the registry and a standard user doesn't have such permission, so it was necessary to elevate to admin.

I created a couple of test accounts on that system, one admin and one standard. I have definitely changed permissions on the original accounts that were not intended, by comparing to the new ones. I need to learn more about this. I may try that utility you referenced first, but I might end up just clean installing Windows and starting over with more attention to the process.