I have a question about allowing regular users to run as an administrator with Windows 7 but I can't find a clear answer for this. We are currently running Windows XP and our users are added to the 'Power Users' group and the 'Users' group. For many of our developers we create a second AD account and name it slightly different from their regular account and add this to the 'Administrator' account. All Exchange and security group access is set through their primary account and the admin account should only be used when they need to install or modify software. Having said that I was wondering if it is acceptable practice to put the user in the Administrator, Power Users, and Users groups on their regular logon? With UAC this would allow them to run as a regular user and when they need admin access they would not have to logout or use the 'run-as' feature. Is it good practice to have users in the Administrator group with Windows 7? This would be a limited group of users that all have separate admin accounts so is there going to be a problem if they are configured this way? Thanks, Dennis

Hello Dennis, I don't think it is a best practice to create more than one accounts to a single user. It is because that the administrator cannot prevent a standard user to use his/her administrative account. The UAC is effective to prevent malware or virus to use the administrative account to harm the computer. However, it doesn't work for staff who have administrative account to use administrative security token. My suggestion is to set/delegate the least and proper permission scope to each developer. The component called "Authorization Manager" (azman.msc) shipped with Windows 7 and Windows Server 2008 R2 may help you assign proper permission on client sides. For more reference on this tool, please refer to: Overview of Authorization Manager http://technet.microsoft.com/en-us/library/cc732203.aspx Thanks. Regards, Miya This posting is provided "AS IS" with no warranties, and confers no rights. | Please remember to click "Mark as Answer" on the post that helps you, and to click "Unmark as Answer" if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Hi Miya, Thank you very much for replying to my thread, this is exactly the infomation I needed to know. Dennis

Hi Dennis, Glad to hear it helps. Welcome to ask questions in Windows 7 forum. Best Regards, Miya Yao TechNet Subscriber Support in forum. If you have any feedback on our support, please contact tngfb@microsoft.com This posting is provided "AS IS" with no warranties, and confers no rights. | Please remember to click "Mark as Answer" on the post that helps you, and to click "Unmark as Answer" if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.