Windows XP introduced a new way to handle multiple user accounts on the same computer: Fast User Switching. This feature, enabled by default, allows the computer to be switched between multiple accounts that are signed in locally without having to log any of them off. Since these are completely separate user accounts, they each run with their own level of privileges and restrictions, which is useful for running applications with elevated privileges when needed, but in a controlled context.
For instance, the default user account -- the one people sign on with to do regular work -- can run with restricted permissions. A second account with elevated administrative credentials could also be created. When a user needs to install a program, he or she can switch to the admin context (without having to sign out or reboot), install the needed application and then switch back.
Note that in many cases, a program that requires administrative privileges to install must reboot the system anyway, since it might install kernel drivers or other low-level components. However, many programs don't require a hard reboot when installing, but still require administrative access, and can be quickly installed in this fashion.
Also, if you're testing a program's behavior in multiple user contexts, for instance, Fast User Switching is a convenient way to do this without having to log out and back in again -- or without having to set up another machine, virtual or physical, to test on.
To enable Fast User Switching, go to Control Panel | User Accounts and select Change the way users log on or off. In the next screen, select Use Fast User Switching and click Apply Options. After that, you will be able to switch to another user context by pressing Winkey+L, or by clicking Start | Log Off | Switch Users.
One of the big downsides to Fast User Switching is that each time an additional user signs on in this fashion, it takes up a fair amount of memory -- typically about 10 MB per user. But that value can vary enormously if additional user(s) have, for instance, programs that load automatically at logon. For this reason, Fast User Switching works best on a machine with 256 MB of physical RAM or more. That said, if you're just using the alternate user context to install an application and nothing else, the memory demand should not be very high.
The most severe limitation of Fast User Switching for privilege elevation is that it will not work on a Windows XP Professional computer that has been joined to a domain. Neither will it work in environments where a third-party logon/identification product is being used, i.e., anything that replaces the MSGINA.DLL component (Microsoft Graphical Identification and Authentication DLL). (Novell Inc.'s ZENworks is a good example of such an environment.) In such cases, it's probably best to use a third-party product such as JoeWare's CPAU (Create Process As User) utility to safely run programs in an elevated context when needed.
About the author: Serdar Yegulalp is editor of the Windows Power Users Newsletter. Check it out for the latest advice and musings on the world of Windows network administrators -- and please share your thoughts as well!
More information from SearchWindowsSecurity.com
Tip: Lock down user access and privileges
Checklist: Lock down Joe User's administrator rights
Book Excerpt: Elevating privileges
