Windows 7 : Managing Access Permissions with Group Accounts

On a computer that’s not connected to a domain (most home and many small office computers), the best and easiest way to share files with other people who log on to your computer is to simply copy or move files you want to share to the Public folder or a related subfolder. If you use this technique, you don’t have to worry about file access permissions or privileges, because Windows 7 sets the access permissions for you. If you configure password-protected sharing, you can be sure that only people with accounts on your computer can access your shared data.

For folders other than your personal folders, the personal folders of other people, or Public folders, you can set access permissions to control who has access.

Every Windows 7 computer has the same set of default groups, which includes groups for performing administrative and maintenance tasks. If you’re using an administrator account, your account is a member of the Administrators group. If you’re using a standard user account, your account is a member of the Users group. For most at-home uses of Windows 7, these are the only groups you’ll ever need to use.

Although all Windows 7 computers have the same set of default groups, each computer sees its groups as being different from the local groups on any other computer. This occurs because computers track groups with unique SIDs rather than display names. At the office, your network will have its own unique groups, which are also different from your computer’s groups.

1. Creating Local Groups

If you find that you need additional groups beyond the Administrators and Users groups, you can create local groups on your computer. You create local groups by completing the following steps:

1. Click Start→Control Panel→System and Security→Administrative Tools.

2. Double-click Computer Management.

3. In Computer Management, double-click Local Users and Groups under System Tools.

4. Select the Groups node to display a list of the current groups on your computer, as shown in Figure 1.

Figure 1. Viewing the groups on your computer

1. Right-click Groups and then select New Group. This opens the New Group dialog box, shown in Figure 2.

Figure 2. Creating a group and adding members

1. Type a name and description for the group.

2. Click the Add button.

3. In the Select Users dialog box, shown in Figure 3, type the name of a user you want to add to the group. This must be the username rather than the full name of the account.

Figure 3. Selecting users to add to the group

1. Click Check Names and then do one of the following:

   • If a single match is found for each entry, the dialog box is automatically updated as appropriate and the entry is underlined.

   • If multiple matches are found, you’ll see an additional dialog box that allows you to select the name or names you want to use, and then click OK.

   • If no matches are found, you’ve probably entered an incorrect name. Modify the name in the Name Not Found dialog box and then click Check Names again.

   NOTE

   You must enter the username rather than the full name of the account. If you changed the username, you actually changed the full name associated with the account rather than the username. To view the usernames associated with accounts on your computer, open Computer Management. Double-click Local Users and Groups under System Tools. Select the Users node and then double-click the user account.

2. Repeat step 11 as necessary. When you are finished selecting names, click OK to close the Select Users dialog box.

3. The New Group dialog box is updated to reflect your selections. If you made a mistake, select a name and remove it by clicking Remove.

4. Click Create when you’re finished adding or removing group members.

2. Adding and Removing Local Group Members

You add and remove local group members using Local Users and Groups. Complete the following steps:

1. Click Start→Control Panel→System and Security→Administrative Tools.

2. Double-click Computer Management.

3. In Computer Management, double-click Local Users and Groups under System Tools.

4. Select the Groups node to display a list of the current groups on your computer.

5. Double-click the group with which you want to work.

6. Use the Add button to add user accounts to the group via the Select Users dialog box, as discussed previously.

7. Use the Remove button to remove user accounts from the group. Select the user account you want to remove from the group and then click Remove.

8. Click OK when you are finished.

3. Renaming Local User Accounts and Groups

Because your computer tracks users and groups with SIDs, you can safely change account names at any time without worrying that this will cause problems with access permissions or privileges. Although you can rename any user and group accounts you’ve created, you shouldn’t rename the default user and group accounts without considering the impact these changes may have on other users. For example, if you change the name of the Administrators group to HeadHonchos, you may be the only person who knows that this group was originally the Administrators group. If a year or so from now you forget that you renamed Administrators, you may think this group has mysteriously disappeared from your computer.

To rename a user or group account, complete the following steps:

1. Open Computer Management.

2. In Local Users and Groups, select the Users or Groups folder as appropriate.

3. Right-click the group or account name and then select Rename.

4. Type the new account name and then click a different entry.

4. Deleting Groups

Deleting a group permanently removes it. Once you delete a group, you can’t simply create another group with the same name to get the same permissions because the SID for the new group won’t match the SID for the old group. Deleting built-in accounts can have far-reaching effects on your computer, so don’t do it.

To delete a group, complete the following steps:

1. Open Computer Management.

2. In Local Users and Groups, select the Users or Groups folder as appropriate.

3. Right-click the group and then select Delete.

4. When prompted to confirm, click Yes.