Windows 2000/XP User Switching Author: Basin

Users who use Windows 2000/XP know that it is best not to log on as a member of the Administrator group in daily work. This is because the Administrator has the power to kill system files and is not careful, the system will "stop killing innocent people" and "refuse to play ". Generally, you should log on to the system as a common user (members of Users Group). Because the account of the Users Group cannot modify the system registry settings, operating system files, or program files, therefore, it is inherently immune to viruses and Trojans!

Apparently, using Users Group member logon makes Windows 2000/XP not as vulnerable as Windows 98, but users cannot use applications that can only be executed by the system administrator, for example, system management tasks (Disk fragment programs, etc.) and virtual optical drives.

It seems that the fish and the bear's paw cannot have both sides-however, these Microsoft have already taken into account for us, and it provides us with the "User Switching" feature in Windows 2000/XP. This function is different from user logout. For example, different user accounts are like actors on the stage ), remove all costumes carried by the actor (Applications opened by the user account; user Switching is equivalent to playing a face change (temporarily changing the identity of the user account) for the actors, and does not remove the costumes (retain the session opened by the user account ). Simply speaking, it is just a matter of mouth. Next we will take Windows XP as an example to see how to use the quick user switching function.

Use the logout menu Method

The most common method to switch between users is to access the user switching function through the "logout" menu. Click Start> logout. In the "log out windows" dialog box shown in 1, click switch user. The current session status is retained. On the surface, this is no different from canceling a user, but you can use the switching user method to retain the session opened by the original user account (for example, if you are downloading the software, after switching the user, the download task continues. If you use "deregister", the software download task will be forcibly disabled ).

Fast User Switching

Obviously, the above method is cumbersome: you need to switch to the Administrator environment and then log out. In fact, it is not necessary to take a long trip. We can use the quick user switchover function to directly run the application as an administrator in the current user environment!

Assume that we are in a normal user environment and want to configure the trust domain of the Norton Personal Security Special Police. However, because the current user's "face (I .e. permission)" is not large enough, the firewall configuration program is rejected. Let's offer a quick user to switch the "Knife": Open "Start> All Programs> Norton Internet Security", right-click the "Norton Internet Security" menu item, select the "running mode" menu, the program will open the "Running identity" dialog box, click the "following users" button, and then select an administrator account in the "user name" drop-down list box, enter the corresponding account and password in the "password" text box. Click OK, as shown in figure 2. Next, the system runs the configuration program of the Norton Personal Security Special Police as an administrator!

Use the RunAs command

Friends familiar with Linux/Unix are certainly not unfamiliar with the su command. With this command, users can freely change their faces between Super Users and normal users ". Now Windows 2000/XP has a similar command-RunAs command. RunAs is a doscommand that can only be run in the Windows 2000/XP doscommand window. It allows users to run specified tools and programs with other permissions, rather than the permissions provided by the current logon user account. The syntax is as follows:

RunAs [{/profile |/noprofile}] [/ENV] [/netonly] [/showtrustlevels]

[/Trustlevel]/User: useraccountname Program

Each parameter has the following functions:

/Profile: loads the user configuration file, which is the default parameter of the RunAs command.

/No profile: Do not load the user configuration file, which can improve the loading speed of the application. However, because some applications need to read the configuration file of a specific user, we do not recommend that you use this parameter.

/ENV: Specify the current network environment, rather than the local environment of the user.

/Netonly: indicates that the specified user information is only used for remote access.

/Showtrustlevels: Lists/trustlevel switches.

/Trustlevel: Specifies the authorization level for the application to run.

/User: useraccountname: Specifies the name of the user account under which the program runs. Single-host users can use the following format:

/User: username @ computername

Or/User: computername/Username

The username here should be replaced by a specific user account, and computername indicates the computer name.

Users of the domain or workgroup can use the following format:

/User: usernme @ domainname (workgroupname)

Or/User: domainname (workgroupname)/Username

Here, domainname (workgroupname) refers to the domain name of the computer's domain (or the name of the Working Group ).

Program: Specifies the program or command to run. You can use the RunAs command to start any application, MMC console project, or control panel project. Note that not all projects can be started using RunAs, such as the "Printer" folder and desktop items.

Application instance:

To make the RunAs command "show" out of its extraordinary power, here is an example. Suppose you want to run the Group Policy as Administrator:

(1) Open the "run" dialog box, enter "cmd" and press enter to open the DOS command window;

(2) Enter "RunAs/profile/User: ourcomputer/Administrator" MMC gpedit. msc "at the command prompt and press Enter;

(3) The system will prompt you to enter the password of the administrator account. Note that the entered account is not displayed here! 3.

(4) If the account and password are correct, the system starts the Group Policy Management Program as an administrator.

TIPS:

Obviously, if you enter a long string of commands every time you start the Group Policy Management Program, it will be very cumbersome. Fortunately, RunAs also provides the shortcut creation function. You only need to create a shortcut on the desktop to save the trouble of entering commands each time. Suppose we often run the "Computer Management" program as an administrator:

(1) Right-click the blank area of the desktop, and click "New> shortcut" in the shortcut menu to open the "Create shortcut" Wizard dialog box.

(2) Enter "runas.exe/User: ourcomputer/Administrator" MMC % WINDIR %/system32/compmgmt. msc "in the" preset project parameters "box, specify the shortcut name based on the on-screen prompts, and click" OK.

(3) In the future, you only need to double-click the shortcut to bring up a DOS command window, prompting you to enter the administrator password, enter the correct password, and press enter to start the "Computer Management" program.

Summary

The three User Switching methods described above have their own advantages. Among them, the logout menu method is the most cumbersome, but also the most thorough method. While using the "run identity" dialog box and the RunAs command, although it is relatively simple to use, not all tasks can be completed, for example, set folder sharing.

Note: To use the quick user switching function, you must make sure that the "Secondary Logon" service and the "Fast User Switching Compatibility" service have been started. It is best to set it to automatically start with windows. The methods to open these two services are:

Double-click "Control Panel> Administrative Tools> services" and find the "Fast User Switching Compatibility" service in the window. Double-click the Service Properties dialog box, switch to the "General" tab, and select the "Automatic" option in the "Start type" drop-down list box (4 ),. Switch to the dependency tab to make sure that all the dependent services displayed under it have been set to run automatically, as shown in Figure 5.

Set the "Secondary Logon" service in a similar way. Now, everything is ready. You have nothing to worry about!