It seems kind of odd that in 2006 I would still get these questions, but twice in the past week have I had to explain the truth about Power Users to someone. Typically they are organizations who are trying to limit the rights of their users, who right now run as admins. Unfortunately, they are under the mistaken impression that making those users Power Users will help.

Power Users are simply Administrators who have not made themselves Administrators yet. There are access control lists, privileges, and other settings all over the OS that allow them to do so. Making someone a power users only makes it marginally more difficult to shoot yourself in the foot. It does not actually limit their privileges, nor does it protect them from malware, which can typically run just fine with Power User privilege.

Two related issues usually come up at about this point in the conversation. The first one is that some application requires at least Power User privilege. If that application is not an inherently administrative one it is broken. Period. Return it for a refund or a fixed version.

The second issue that comes up is that the organizaton is going to modify the permissiosn of Power Users so they are less privileged. If that is what you users need then why not make them users in the first place? It is really unlikely that you will be able to cripple Power Users sufficiently and if you do they become users, which is what you should have used in the first place. Some people try to cripple Power Users even though nobody should be in that group. Why? If nobody is in the group what difference does it make what privileges it has? Usually I then get the standard argument that "if someone is able to add themselves to the group..." Only Administrators could do that. If a user can do that they would not make themselves Power Users. That is a completely flawed argument. Besides, most people who try to cripple Power Users run afoul of KB 885409 and end up with a destabilized and unsupported system in the process.

In general, I prefer making people Administrators over Power Users. That way it is obvious that they have extremely elevated rights and a glaring problem is more likely to get fixed than one that is papered over.