How would i go about doing these things

[handscombmp]

Setting up a PC for my brother (15 years old) in my parents house and they want it to have some restrictions on it so he can't get lot's of viruses on it like his last ones.

Currently what i'm planning to do is to install Win 7 or Vista (prob 7 but i have a spare key for vista lie-ing about) and set up 2 accounts. An admin one and one for my brother which will be a limited user acount.

now this is where i start to have problems.
Becasuce it is also a HTPC for him in his room i need it to sync a HDD with another one in a PC over a network. (The HDD isn't the OS one but another one for just media)
I want it to do this automatically in the background when the PC starts up so he doesn't have to worry. (I also want it to automatically log into my brothers account so as far as he knows the admin one doesn't exist)

Then the really tricky but i want to be able to do is to make the storage device so he can't write to it (ideally so he doesn't even know it's there but Mediaportal does).

When si this possible and how would i go about doing it.

[jim]

Just a few ideas spouting off...

Storage drive you can set the permissions on the root so that his user account can only read - that's easy enough. I think you'll struggle to hide it from him though, because MediaPortal will want read access - and since it will be launched with his rights, that means he will need viewing and reading rights for the drive. Alternatively you could run MediaPortal as Admin... but then it needs the admin password to launch so that's not much use.

For automatic logon, go to Start --> Run, and type "control userpasswords2" without the speech marks, fairly self-explanatory from there on in. Works flawlessly in my experience.

Synctoy or similar would be fine for the sync, can combine it with task scheduler to make sure it will run at every logon or every day. Should also make sure at this point that task scheduler will run it with administrator privileges, or else it will run with his privileges and won't be able to write to the data disk.

It won't take him long to figure out the admin account exists as UAC prompts will appear fairly routinely... depends how likely he is to go and ask for someone to type the UAC password so he can install MSN messenger, or alternatively get fed up and try to hack around it.

Anyway, hopefully that's a start, even if I didn't really go in depth with anything. Depends where you want to go with it, what restrictions you want to put in place and what tools you're happy with using and then move on from there.

[handscombmp]

Just a few ideas spouting off...

Storage drive you can set the permissions on the root so that his user account can only read - that's easy enough. I think you'll struggle to hide it from him though, because MediaPortal will want read access - and since it will be launched with his rights, that means he will need viewing and reading rights for the drive. Alternatively you could run MediaPortal as Admin... but then it needs the admin password to launch so that's not much use.

Thought that might be the case. How would you go about setting it so it's read only.
When setting up synctoy to run as admin won't it ask for the password or does task scheduler get round this?

[jim]

Thought that might be the case. How would you go about setting it so it's read only.

Right click disk, properties, security tab. You'll get two groups listed - administrators and users. Click on users, then click edit. Only have "allow" ticked in the following boxes - "Read and Execute", "List Folder Contents", "Read".

When setting up synctoy to run as admin won't it ask for the password or does task scheduler get round this?

As I understand it, it gets around it.

There's a box that says "When running the task, use the following user account". You'd pick administrator in there, and then choose to run it "whether user is logged in or not". That should do the trick, although obviously you'd want to test it first. There's a lot of configuration options in there to check out as well, which might be useful to stop it being mucked around with.

[handscombmp]

One small problem i have though is that when i autorun the task it shows up as a command prompt box which i don't really want.

[jim]

This might work, no guarantees though as I've never used it:

http://www.ntwind.com/software/utilities/hstart.html

[Splash]

Doesn't MediaPortal run as a service? If so... create a local account for the mediaportal service to run as which has permissions on the storage volume, then it should be able to access all the data you're talking about, and your brother can continue to run as a restricted user.


Disclaimer: I have never used MediaPortal.

[jim]

I use it personally, but wasn't aware of it that being a possibility. I'll check later if I get chance.