Need to be rid of some filler in XP Pro SP3

[trimis]

I would like to eliminate (not disable) the following built-in group accounts:
backup operators
guest
network configuration operators
power users
remote desktop users
replicator
help services group
Is there a way to permanently uninstall, delete, erase, etc., any (or hopefully all) the above without harming the OS? I only need one administrator account and one limited account. The rest needs to be nuked.

 

[Elizabeth23]

http://superuser.com/questions/4610...p-default-administrator-as-only-administrator

in reply 4 of above link there is a command line for net localgroup and this will list all groups, if you type in

net localgroup /?

you will get the help section and it shows what you can do with this command there is a delete.

but first read the article below as to what you can safely delete

https://www.microsoft.com/resources...proddocs/en-us/lsm_delete_group.mspx?mfr=true

==

 

[trimis]

http://superuser.com/questions/4610...p-default-administrator-as-only-administrator

in reply 4 of above link there is a command line for net localgroup and this will list all groups, if you type in

net localgroup /?

you will get the help section and it shows what you can do with this command there is a delete.

but first read the article below as to what you can safely delete

https://www.microsoft.com/resources...proddocs/en-us/lsm_delete_group.mspx?mfr=true

==

Thanks for the link. Unfortunately it says:

The following built-in groups cannot be deleted:

•
Administrators

•
Backup Operators

•
Power Users

•
Users

•
Guests

•
Replicator

..which are exactly the ones I want to be rid of! Surely there is some way around this? Registry hack? XPLite/nLite? Something?

 

[Elizabeth23]

all of the info I have read, says to disable, but NOT delete, you can delete them but I believe this would make your pc inop as microsoft has made lots of things that are tied in together and to delete something might make something else not work.

-----------

I have all of these and have nobody in these groups they are just there.

sorry, I could not find an exact reason as to why they should not be deleted.

-----------------

when you use nlite to customize your xp install and you go to the components tab, there are lots of things in red and these are needed by xp, even if it is something you do not use, nlite has done extensive studies on what is needed and in their forums you can read numerous threads on people who have deleted the wrong things in their install and have to create a new cd.

I really do not recommend deleteing these.

==

 

[Jody Thornton]

You could visit the Black Viper site and see what every service does, and what happens when you disable them. Again, he doesn't promote service deletions.

I used nLite to remove obvious things like System Restore and Indexing completely, plus Wireless service (I had a wired desktop). But this involved creating an OS installation CD-ROM with this stuff removed. You have to be careful what you take out as you could "break" the OS.

 

[trimis]

http://superuser.com/questions/4610...p-default-administrator-as-only-administrator

in reply 4 of above link there is a command line for net localgroup and this will list all groups, if you type in

net localgroup /?

you will get the help section and it shows what you can do with this command there is a delete.

but first read the article below as to what you can safely delete

https://www.microsoft.com/resources...proddocs/en-us/lsm_delete_group.mspx?mfr=true

==

Already found the page you linked to, and this:

The following built-in groups cannot be deleted:

•
Administrators

•
Backup Operators

•
Power Users

•
Users

•
Guests

•
Replicator


is what I want to either uninstall (since they cannot be deleted), or failing that, at the very least do whatever necessary to insure that no accounts can ever be created in these groups. As said, I only need one administrator account and one limited account. All else will never be used by me, but such accounts could be opened by scriptkiddies.

 

[trimis]

all of the info I have read, says to disable, but NOT delete, you can delete them but I believe this would make your pc inop as microsoft has made lots of things that are tied in together and to delete something might make something else not work.

-----------

I have all of these and have nobody in these groups they are just there.

sorry, I could not find an exact reason as to why they should not be deleted.

-----------------

when you use nlite to customize your xp install and you go to the components tab, there are lots of things in red and these are needed by xp, even if it is something you do not use, nlite has done extensive studies on what is needed and in their forums you can read numerous threads on people who have deleted the wrong things in their install and have to create a new cd.

I really do not recommend deleteing these.

==

Well, if I cannot uninstall any of these built-in groups, then I guess disabling them is poor second choice (since anything that can be disabled can be re-enabled), but its better than nothing! Could you please point me to DIY on how to disable the ability to create accounts in these groups, or some other way to lockdown? Thanks!

 

[Elizabeth23]

as per the picture you can deny access to any group you choose, and/or remove from the security list.

the link below has a neat check tool to see which group has access to which files:

http://blogs.technet.com/b/markrussinovich/archive/2006/05/01/the-power-in-power-users.aspx

================

http://www.utilizewindows.com/xp-menu/users-and-groups/171-group-management-in-xp

above has more info on these groups and pictures to show how to add or remove users from a specific group

this is all I can come up with, since windows has several things linked together this is probably why the groups cannot be simply deleted.

Hope this helps.

==

 

[Jody Thornton]

Well, if I cannot uninstall any of these built-in groups, then I guess disabling them is poor second choice (since anything that can be disabled can be re-enabled), but its better than nothing! Could you please point me to DIY on how to disable the ability to create accounts in these groups, or some other way to lockdown? Thanks!

I see it as you are trying to make Windows XP into a single-user OS, is that right?

Basically you'd be re-engineering the OS. The whole idea behind Windows NT class OSs is that you can accommodate multiple users. You need Administrator and perhaps Power User if you want to do limited configuration. User accounts are meant to be a feature restricted and secure method of operating your computer. Also the "user" account can actually run faster because the CPU does not poll for Performance Counters, as it does in the Admin and higher-grade account types.

 

[trimis]

as per the picture you can deny access to any group you choose, and/or remove from the security list.

the link below has a neat check tool to see which group has access to which files:

http://blogs.technet.com/b/markrussinovich/archive/2006/05/01/the-power-in-power-users.aspx

================

http://www.utilizewindows.com/xp-menu/users-and-groups/171-group-management-in-xp

above has more info on these groups and pictures to show how to add or remove users from a specific group

this is all I can come up with, since windows has several things linked together this is probably why the groups cannot be simply deleted.

Hope this helps.

==

Thanks for the assist, and your patience! While this is definitely not what I was wanting, occasionally something is better than nothing. Guess as long as this stops JDs from creating accounts in these groups, its maybe the best I can hope for!

 

[trimis]

I see it as you are trying to make Windows XP into a single-user OS, is that right?

Basically you'd be re-engineering the OS. The whole idea behind Windows NT class OSs is that you can accommodate multiple users. You need Administrator and perhaps Power User if you want to do limited configuration. User accounts are meant to be a feature restricted and secure method of operating your computer. Also the "user" account can actually run faster because the CPU does not poll for Performance Counters, as it does in the Admin and higher-grade account types.

Yes, just me, and I only need an administrator account, and a limited account. To some degree I guess one could say that I am remaking the OS, as I will be using either nlite or XPlite to cut the bloat (IRC, Telnet, etc.), and the more useless junk I can jettison the better...especially the security flaws.
Now its a matter of finding out what can be ditched with making the OS unstable. Its a big disappointment to find out that these groups cannot be nuked, but I'll live!