Create a "subadministrator" working group for Windows XP users

Http://techrepublic.com.com/5100-10877_11-5768233.html? Tag = NL. e064

Create a 'subadmin' group for Windows XP users
Create a "subadministrator" Workgroup for Windows XP users

By Greg Shultz

Takeaway:
For security reasons, you shoshould dictate which privileges certain users have when they're working in Windows XP, either in a stand-alone configuration or in a peer-to-peer network. in order to give users a broad range of system admin capabilities and restrict them from accessing all system resources, you can create a 'subadmin' group.
Overview:
Whether it's a self-configured computer or a computer in a point-to-point network, you need to authorize users who use Windows XP for security reasons. To grant administrator-level permissions and restrict access to all system resources, you can create a "subadministrator" Working Group.

Windows XP Professional provides you with a number of built-in local groups with specific privileges. when setting up stand-alone systems or systems that will participate in peer-to-peer networks, you can assign local user accounts to these groups in order to dictate how much control users have when they're working in the operating system.
Windows XP Professional Edition provides you with built-in local workgroup with specific permissions. When creating an independently configured system or a point-to-point network system, you can assign local user accounts to these groups so that they have certain permissions in the operating system.

In most cases, you assign user accounts to the Users Group. However, if you want to give certain users more control over the system, you can assign those accounts to the Power Users Group.
In most cases, you assign a user account to the user workgroup. However, if you want to give more system control to reliable users, you may allocate these accounts to the powseruser workgroup.

When the Power Users group doesn't quite provide the privileges that you want, it's very easy to simply reassign the account to the Administrators group and call it a day. however, that can be a dangerous proposition in itusituations.
When the powseruser workgroup does not properly provide the permissions you need, it is easy to assign an account to the administrators workgroup. However, this is a dangerous action under certain conditions.

A much wiser choice wocould be to add the user's account to the Backup Operators Group, in addition to the Power Users Group. the combination of privileges from both of these local groups give the user account a broad range of system administration capabilities, without giving access to all the system resources to which the Administrators group has access. you can think of the combination of these two groups as a "subadministrator" group.
The more sensible choice is to add a user account to the Backup Operators workgroup and the Power Users workgroup. The permissions of these workgroup groups are granted to the user at the account administrator level, but not to all system resources that the administrators workgroup can access. You can imagine the combination of the two working groups as the "subadministrator" Working Group.