How to add a user to a group on windows

Sometimes a PC is shared by number of people greater than one. In some cases all of the users need to have full access of the PC. In such cases guest accounts does not work well. The best solution for this is to add user to local administrator group on the PC. There are few ways discussed in this piece of writing for resolving the issues of how to add user as administrator to the PC.

Part 1. Add a (Domain) User to Local Administrator Group in Windows Computer Management

This method explains the steps to add domain user to local admin group. Follow the directions as mentioned below.

1. Press “R” from the keyboard along with Windows button to launch “Run”. In the text field type in “compmgmt.msc” and click on “OK” to launch “Computer Management”

How to add a user to a group on windows

2. After launching “Computer Management” go to “System Tools” on the left side of the panel. Under it locate “Local Users and Groups” folder. Within it, click on “Groups” folder.

How to add a user to a group on windows

3. In the main menu a number of groups will appear, select the desired group to add the member which in this case is “Administrators”.

4. Make a right click one the group named “Administrators” and click on “Add to Group” from the drop down menu.

5. A pop up will appear asking for confirmation of the action, click on “Add” from the options and then click on “OK”.

6. A dialog box will come up in the screen named as “Select Groups” to get more information about the account to be set up. do the following to set up an administrator account: In the “Enter the object names to select” type in the name of the account whether user or group which is needed to be added. Then click on “OK” to confirm.

If the user wants to add a computer account then he or she is advised to click on “Object Types”. Tick the “Computers” box and again click on “OK” to save the changes. Now in the “Enter the object names to select” type in name of the computer account which is needed to be added. Then click on “OK” to confirm.

How to add a user to a group on windows

7. These steps will add the administrator account on the PC. However, this method is not applicable to each and every version of Windows like Windows 8 Home edition.

Part 2. Add a User to Local Administrator Group using Command Prompt

Another way to add up users as administrator in the PC is to add user to admin group cmd. Writing a few lines of command in the command prompt will let the user add more people to the PC. One more advantage of this method is that this method is applicable to every edition of Windows i.e. Windows 10/8/7/vista. To add user to local administrator group command line an elevated Command prompt is needed rather than the usual one

1. To open the elevated Command Prompt press “X” along with Windows key from the keyboard in case of Windows 10 and 8. In case of Windows 7 or vista go to “Start” and search for “command prompt” and make a right click on the same from the search result. Then select “Run as Administrator” from the drop down menu.

How to add a user to a group on windows

2. Now the elevated command prompt is launched. For discovering the names of the local groups type in the following command in the command prompt:

3. And press “Enter” from the keyboard

4. To add an administrator account to Administrator group use the following command:

“net localgroup Administrator [username] /add”

5. And press “Enter”. Username will be the name of the account.

How to add a user to a group on windows

Part 3. How to Remove a User from Local Administrator Group

After knowing how to make a user an administrator windows 10 now to remove the undesired or unreasonable accounts from the administrator post is a thing to learn about. Process of removal of administrator account varies depending on the edition of Windows operating system and source region of the account folder.

Remove a User from Local Administrator Group in Local Users and Groups (Windows 10):

1. Local Users and Groups is only available in the Windows 10 Pro, Enterprise, and Education editions.

2. Press “R” from the keyboard along with the Windows key to launch “Run”.

3. In the text field of “Run” type in “lusrmgr.msc” and click on “OK”. This will open “Local Users and Groups”.

How to add a user to a group on windows

4. If the account is in “Groups” under “Groups” folder in “Local Users and Groups, select “Groups” from the left side panel of the window. Click on the group name wished to remove uses as members of and select Properties” from the drop down menu. Select a user name and click on the “Remove” button and then click on “OK” to confirm the removal.

How to add a user to a group on windows

Remove a User from Local Administrator Group in Command Prompt (For All Windows):

1. Open an elevated command prompt to continue this process by following this steps.

2. Press “X” along with Windows key from the keyboard in case of Windows 10 and 8.

3. In case of Windows 7 or vista go to “Start” and search for “command prompt” and make a right click on the same from the search result. Then select “Run as Administrator” from the drop down menu.

How to add a user to a group on windows

4. Type in the below mentioned command in the command line and press “Enter” to run it:

5. “net localgroup “Group” “User” /delete”

How to add a user to a group on windows

6. The “Group” and the “User” in this command should be replaced by the real name of the group and user to be removed respectively.

Additional Tip: How to Add a User to Remote Desktop User Group/ Debugger User Group/Power User Group

The best way to add a user to remote desktop is to use command prompt. Use an elevated command prompt and then type the commands as mentioned below to add the user in the desired groups.

Open the elevated Command Prompt by pressing “X” along with Windows key from the keyboard in case of Windows 10 and 8. In case of Windows 7 or vista go to “Start” and search for “command prompt” and make a right click on the same from the search result. Then select “Run as Administrator” from the drop down menu. Now the elevated command prompt is launched. Type the respective commands to add users to the respective groups:

1. To add in remote desktop users groups:

“net localgroup “Remote Desktop Users” UserLoginName /add”

2. To add in debugger users group:

“net localgroup “Debugger users” UserLoginName /add”

3. To add in power users group:

“net localgroup “Power users” UserLoginName /add”

Except for adding administrator accounts in the PC, there are other problems like forgetting the password which make people suffer a lot. But with the use of a simple tool named 4WinKey. This simple software can come in real handy for the problems related to lost password of WINDOWS 10 PC.

After creating server user account in Windows server 2012 (R2), how to add the user to local administrator group to grant it administrator privileges? This passage will tell you two easy ways to achieve this goal.

The following ways are introduced using server 2012 (R2) computer, and also apply to Windows 7 and Windows server 2008 (R2).

1. Add user to local administrator group via computer management

Step 1: Press Win +X to open Computer Management

Step 2: In the console tree, click Groups.
Computer Management\System Tools\Local Users and Groups\Groups

Step 3: Right-click the group to which you want to add a member, click Add to Group, and then click Add.

How to add a user to a group on windows

Step 4: In the Select Users (Computers, or Groups) dialog box, do the following:

How to add a user to a group on windows

  • To add a user account or group account to this group, under Enter the object names to select , type the name of the user account or group account that you want to add to the group, and then click OK .
  • To add a computer account to this group, click Object Types, select the Computers check box, and then click OK. Under Enter the object names to select, type the name of the computer account that you want to add to the group, and then click OK.

2. Add user to local administrator group via net user command

Login into Windows server 2012 (r2) with administrator, and then do as following:

Step 1: Press Win + X to run Command Prompt (Admin).
In other Windows operational systems, you may have to click “Start”, type “cmd” and press Enter to run command prompt.

Step 2: Type “net user” command to see what the user accounts are on Windows server 2012 (R2).

How to add a user to a group on windows

Step 3: Type the following command to add user account “genius” to local administrators group. And press Enter to complete this command.
net localgroup administrators genius /add

Sometimes a PC is shared by number of people greater than one. In some cases all of the users need to have full access of the PC. In such cases guest accounts does not work well. The best solution for this is to add user to local administrator group on the PC. There are few ways discussed in this piece of writing for resolving the issues of how to add user as administrator to the PC.

Part 1. Add a (Domain) User to Local Administrator Group in Windows Computer Management

This method explains the steps to add domain user to local admin group. Follow the directions as mentioned below.

1. Press “R” from the keyboard along with Windows button to launch “Run”. In the text field type in “compmgmt.msc” and click on “OK” to launch “Computer Management”

How to add a user to a group on windows

2. After launching “Computer Management” go to “System Tools” on the left side of the panel. Under it locate “Local Users and Groups” folder. Within it, click on “Groups” folder.

How to add a user to a group on windows

3. In the main menu a number of groups will appear, select the desired group to add the member which in this case is “Administrators”.

4. Make a right click one the group named “Administrators” and click on “Add to Group” from the drop down menu.

5. A pop up will appear asking for confirmation of the action, click on “Add” from the options and then click on “OK”.

6. A dialog box will come up in the screen named as “Select Groups” to get more information about the account to be set up. do the following to set up an administrator account: In the “Enter the object names to select” type in the name of the account whether user or group which is needed to be added. Then click on “OK” to confirm.

If the user wants to add a computer account then he or she is advised to click on “Object Types”. Tick the “Computers” box and again click on “OK” to save the changes. Now in the “Enter the object names to select” type in name of the computer account which is needed to be added. Then click on “OK” to confirm.

How to add a user to a group on windows

7. These steps will add the administrator account on the PC. However, this method is not applicable to each and every version of Windows like Windows 8 Home edition.

Part 2. Add a User to Local Administrator Group using Command Prompt

Another way to add up users as administrator in the PC is to add user to admin group cmd. Writing a few lines of command in the command prompt will let the user add more people to the PC. One more advantage of this method is that this method is applicable to every edition of Windows i.e. Windows 10/8/7/vista. To add user to local administrator group command line an elevated Command prompt is needed rather than the usual one

1. To open the elevated Command Prompt press “X” along with Windows key from the keyboard in case of Windows 10 and 8. In case of Windows 7 or vista go to “Start” and search for “command prompt” and make a right click on the same from the search result. Then select “Run as Administrator” from the drop down menu.

How to add a user to a group on windows

2. Now the elevated command prompt is launched. For discovering the names of the local groups type in the following command in the command prompt:

3. And press “Enter” from the keyboard

4. To add an administrator account to Administrator group use the following command:

“net localgroup Administrator [username] /add”

5. And press “Enter”. Username will be the name of the account.

How to add a user to a group on windows

Part 3. How to Remove a User from Local Administrator Group

After knowing how to make a user an administrator windows 10 now to remove the undesired or unreasonable accounts from the administrator post is a thing to learn about. Process of removal of administrator account varies depending on the edition of Windows operating system and source region of the account folder.

Remove a User from Local Administrator Group in Local Users and Groups (Windows 10):

1. Local Users and Groups is only available in the Windows 10 Pro, Enterprise, and Education editions.

2. Press “R” from the keyboard along with the Windows key to launch “Run”.

3. In the text field of “Run” type in “lusrmgr.msc” and click on “OK”. This will open “Local Users and Groups”.

How to add a user to a group on windows

4. If the account is in “Groups” under “Groups” folder in “Local Users and Groups, select “Groups” from the left side panel of the window. Click on the group name wished to remove uses as members of and select Properties” from the drop down menu. Select a user name and click on the “Remove” button and then click on “OK” to confirm the removal.

How to add a user to a group on windows

Remove a User from Local Administrator Group in Command Prompt (For All Windows):

1. Open an elevated command prompt to continue this process by following this steps.

2. Press “X” along with Windows key from the keyboard in case of Windows 10 and 8.

3. In case of Windows 7 or vista go to “Start” and search for “command prompt” and make a right click on the same from the search result. Then select “Run as Administrator” from the drop down menu.

How to add a user to a group on windows

4. Type in the below mentioned command in the command line and press “Enter” to run it:

5. “net localgroup “Group” “User” /delete”

How to add a user to a group on windows

6. The “Group” and the “User” in this command should be replaced by the real name of the group and user to be removed respectively.

Additional Tip: How to Add a User to Remote Desktop User Group/ Debugger User Group/Power User Group

The best way to add a user to remote desktop is to use command prompt. Use an elevated command prompt and then type the commands as mentioned below to add the user in the desired groups.

Open the elevated Command Prompt by pressing “X” along with Windows key from the keyboard in case of Windows 10 and 8. In case of Windows 7 or vista go to “Start” and search for “command prompt” and make a right click on the same from the search result. Then select “Run as Administrator” from the drop down menu. Now the elevated command prompt is launched. Type the respective commands to add users to the respective groups:

1. To add in remote desktop users groups:

“net localgroup “Remote Desktop Users” UserLoginName /add”

2. To add in debugger users group:

“net localgroup “Debugger users” UserLoginName /add”

3. To add in power users group:

“net localgroup “Power users” UserLoginName /add”

Except for adding administrator accounts in the PC, there are other problems like forgetting the password which make people suffer a lot. But with the use of a simple tool named 4WinKey. This simple software can come in real handy for the problems related to lost password of WINDOWS 10 PC.

Adds members to a local group.

Syntax

Description

The Add-LocalGroupMember cmdlet adds users or groups to a local security group. All the rights and permissions that are assigned to a group are assigned to all members of that group.

Members of the Administrators group on a local computer have Full Control permissions on that computer. Limit the number of users in the Administrators group.

If the computer is joined to a domain, you can add user accounts, computer accounts, and group accounts from that domain and from trusted domains to a local group.

If the computer is joined to a domain and you try to add a local user that has the same name as a member of the domain it adds the domain member.

Examples

Example 1: Add members to the Administrators group

This command adds several members to the local Administrators group. The new members include a local user account, a Microsoft account, an Azure Active Directory account, and a domain group. This example uses a placeholder value for the user name of an account at Outlook.com.

Parameters

Prompts you for confirmation before running the cmdlet.

Type: SwitchParameter
Aliases: cf
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

Specifies the security group to which this cmdlet adds members.

Type: Microsoft.PowerShell.Commands.LocalGroup
Position: 0
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

Specifies an array of users or groups that this cmdlet adds to a security group. You can specify users or groups by name, security ID (SID), or LocalPrincipal objects.

Type: Microsoft.PowerShell.Commands.LocalPrincipal [ ]
Position: 1
Default value: None
Accept pipeline input: True
Accept wildcard characters: False

Specifies the name of the security group to which this cmdlet adds members.

Type: String
Position: 0
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

Specifies the security ID of the security group to which this cmdlet adds members.

Type: SecurityIdentifier
Position: 0
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

Shows what would happen if the cmdlet runs. The cmdlet is not run.

Type: SwitchParameter
Aliases: wi
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

Inputs

System.Management.Automation.SecurityAccountsManager.LocalGroup, System.String, System.Security.Principal.SecurityIdentifier

You can pipe a local principal, a string, or a SID to this cmdlet.

Outputs

None

This cmdlet does not generate any output.

Notes

The Microsoft.PowerShell.LocalAccounts module is not available in 32-bit PowerShell on a 64-bit system.

The PrincipalSource property is a property on LocalUser, LocalGroup, and LocalPrincipal objects that describes the source of the object. The possible sources are as follows:

  • Local
  • Active Directory
  • Azure Active Directory group
  • Microsoft Account

PrincipalSource is supported only by Windows 10, Windows Server 2016, and later versions of the Windows operating system. For earlier versions, the property is blank.

Apart from what is visible to you on the login screen, Windows 10 tends to create several users and groups in the background to carry out several tasks on a computer. However, they are not visible to a normal user and are logged in in the background and serve a great deal in permission structuring. Let us learn how to see and to manage Local Users and groups on a Windows 10/8/7 on the computer.

Open Local Users and Groups on Windows 10

The following methods will help you to open and view Local Users and Groups on Windows 10:

  1. Using the Computer Management utility
  2. Directly by using lusrmgr.msc.

Let us look at the procedure in detail. We will also take a look at how to add or remove Users from a Group.

1] Using the Computer Management utility

How to add a user to a group on windows

Open the WinX menu and select Computer Management.

From the left side navigation panel, select Local Users and Groups under the expanded list of Computer Management (Local).

You will see two folders here:

  1. Users and
  2. Groups.

Expanding each will give you the required details.

2] Directly by using lusrmgr.msc

To open Local Users and Groups window, you have to invoke its process, which is called lusrmgr.msc, and you can do this in the following four ways.

Using the Run box

Hit the Windows Key + R button combination on your keyboard.

Type in lusrmgr.msc and hit Enter.

It will open the Local Users and Groups window.

Using Windows Search box

Hit the Windows Key + S button combination on your keyboard. It will launch the Windows Search Box.

Search for lusrmgr.msc and hit Enter.

The Local Users and Group window will now be open.

Using Windows 10 Command Prompt

Open Windows Command Prompt and execute the following command:

You will arrive at your destination window.

Using Windows PowerShell command line

Open Windows PowerShell and execute the following command:

It will open at your destination window.

Add or remove Users from Group

How to add a user to a group on windows

To add or remove Users from a Group:

  1. Open the Groups folder
  2. Select the Group
  3. Double-click on the group
  4. Under the Members box, select the user you want to delete.
  5. Click on the Delete button.

To add a User, click the Add button and follow the process.

Add a User to Group using Command Prompt

You need to execute the following command:

Replace GROUP and USER with the actual names.

Remove a User from a Group using Command Prompt

You need to execute the following command:

Replace GROUP and USER with the actual names.

Add a User to Group using PowerShell

You need to execute the following command:

Replace GROUP and USER with the actual names.

Remove a User from a Group using PowerShell

You need to execute the following command:

Replace GROUP and USER with the actual names.

I hope this helps.

Windows 10 Home user? These links may interest you:

  1. Use freeware Lusrmgr tool to access Local User and Group Management in Windows 10 Home
  2. Open and Manage Local User and Group Management in Windows 10 Home using Command Prompt or PowerShell.

Date: October 17, 2019 Tags: User Account

Related Posts

How to add a user to a group on windows

How to remove deleted User Account from login screen in Windows 10

How to recover deleted User account profile in Windows 10

Users must enter a username and password to use this computer missing in Windows 10

[email protected]

Anand Khanse is the Admin of TheWindowsClub.com, a 10-year Microsoft MVP (2006-16) & a Windows Insider MVP. Please read the entire post & the comments first, create a System Restore Point before making any changes to your system & be careful about any 3rd-party offers while installing freeware.

Primary Sidebar

report this ad

You can add someone to your family group on your PC, on Xbox, or in the Microsoft Family Safety app. To learn more about the benefits of a family group and how to set one up, see What is a Microsoft family group?

Note: Your family group is a way to manage how members of your family use their Microsoft accounts. If you’re just trying to add an account to your own PC, see Create a local user or administrator account in Windows 10.

Add someone in the Family Safety app

If you already have a family group created and sign in to the Microsoft Family Safety app, they’ll appear automatically. To add more family members, or add some after you create a family:

Sign in to Family Safety with your Microsoft account.

Tap Add someone at the bottom of your home screen.

Enter a phone number or email address to invite someone, or create a new email and account for them (like if they’re a child).

Decide if you want them to be an Organizer or a Member, then send the invite.

Add someone on the web

We’ll email or text an invitation to each person you want to add and they’ll need to accept to join the family group. If you’re adding an account for a young child, you can set up an email address and monitor it.

To add someone to your family group:

Sign in with your Microsoft account, then select Add a family member.

Select Member or Organizer.

Enter an email address or phone number for the person you want to add, then select Send invite.

Note: If the person you’re adding is already part of another family group, they’ll first need to be removed from that family group, or they’ll need a new Microsoft account for your family group.

Have the person you invited accept your invitation from the email or text message they receive. Or, in the Notifications section, select Accept now next to Pending member. You’ll be signed out so the person you’re trying to add can sign in to their account and accept the invitation.

Add someone on Xbox

The way you add someone to your family group on Xbox depends on whether they’re new to Xbox Live or already have an Xbox Live account. For kids who are new to Xbox Live, add them to your family group on the console, then manage their family settings on family.microsoft.com. Otherwise, they may not appear in your list of family members on the console.

If your family member doesn’t have an Xbox Live account

Press the Xbox button to open the guide, then select Sign in and sign in with your account.

Press the Xbox button again and select Profile & system > Settings > Account > Family settings > Manage family members > Add to family > Add new.

When the person you want to add is prompted to sign in using their Microsoft account email address, press B on your controller, then move the left stick down to select Get a new account, and have them follow the steps to create a Microsoft account.

When you’re prompted, select Add to family.

If your family member has an Xbox Live account on your console

Press the Xbox button to open the guide, then select Sign in and sign in with your account.

Press the Xbox button again and select Profile & system > Settings > Account > Family settings > Manage family members > Add to family.

Select the profile for the person you want to add, then press the A button on your controller.

If your family member has an Xbox Live account that’s not on your console

Press the Xbox button to open the guide, then select Sign in and sign in with your account.

Press the Xbox button again and select Profile & system > Settings > Account > Family settings > Manage family members > Add to family > Add new.

Have the person you want to add sign in with their Microsoft account email address and password, and when you’re prompted, select Add to family.

Managing accounts for kids

For more information on managing a member account when they’re a child, see:

If you want to share software subscriptions or Xbox features, see:

Add new users or delete existing users from your Azure Active Directory (Azure AD) organization. To add or delete users you must be a User administrator or Global administrator.

Add a new user

You can create a new user using the Azure Active Directory portal.

To add a new user, follow these steps:

Sign in to the Azure portal as a User administrator for the organization.

Search for and select Azure Active Directory from any page.

Select Users, and then select New user.

How to add a user to a group on windows

On the User page, enter information for this user:

Name. Required. The first and last name of the new user. For example, Mary Parker.

User name. Required. The user name of the new user. For example, [email protected] .

The domain part of the user name must use either the initial default domain name, .onmicrosoft.com, or a custom domain name, such as contoso.com. For more information about how to create a custom domain name, see Add your custom domain name using the Azure Active Directory portal.

Groups. Optionally, you can add the user to one or more existing groups. You can also add the user to groups at a later time. For more information about adding users to groups, see Create a basic group and add members using Azure Active Directory.

Directory role: If you require Azure AD administrative permissions for the user, you can add them to an Azure AD role. You can assign the user to be a Global administrator or one or more of the limited administrator roles in Azure AD. For more information about assigning roles, see How to assign roles to users.

Job info: You can add more information about the user here, or do it later. For more information about adding user info, see How to add or change user profile information.

Copy the autogenerated password provided in the Password box. You’ll need to give this password to the user to sign in for the first time.

Select Create.

The user is created and added to your Azure AD organization.

Add a new guest user

You can also invite new guest user to collaborate with your organization by selecting Invite user from the New user page. If your organization’s external collaboration settings are configured such that you’re allowed to invite guests, the user will be emailed an invitation they must accept in order to begin collaborating. For more information about inviting B2B collaboration users, see Invite B2B users to Azure Active Directory

Add a consumer user

There might be scenarios in which you want to manually create consumer accounts in your Azure Active Directory B2C (Azure AD B2C) directory. For more information about creating consumer accounts, see Create and delete consumer users in Azure AD B2C.

Add a new user within a hybrid environment

If you have an environment with both Azure Active Directory (cloud) and Windows Server Active Directory (on-premises), you can add new users by syncing the existing user account data. For more information about hybrid environments and users, see Integrate your on-premises directories with Azure Active Directory.

Delete a user

You can delete an existing user using Azure Active Directory portal.

You must have a Global administrator or User administrator role assignment to delete users in your organization. Global admins can delete any users including other admins. User administrators can delete any non-admin users, Helpdesk administrators and other User administrators. For more information, see Administrator role permissions in Azure AD.

To delete a user, follow these steps:

Sign in to the Azure portal using a User administrator account for the organization.

Search for and select Azure Active Directory from any page.

Search for and select the user you want to delete from your Azure AD tenant. For example, Mary Parker.

Select Delete user.

How to add a user to a group on windows

The user is deleted and no longer appears on the Users – All users page. The user can be seen on the Deleted users page for the next 30 days and can be restored during that time. For more information about restoring a user, see Restore or remove a recently deleted user using Azure Active Directory.

When a user is deleted, any licenses consumed by the user are made available for other users.

To update the identity, contact information, or job information for users whose source of authority is Windows Server Active Directory, you must use Windows Server Active Directory. After you complete the update, you must wait for the next synchronization cycle to complete before you’ll see the changes.

Next steps

After you’ve added your users, you can do the following basic processes:

Or you can do other user management tasks, such as adding guest users from another directory or restoring a deleted user. For more information about other available actions, see Azure Active Directory user management documentation.

Can it really be the case that, having accepted Windows 10 Home, I am not permitted the simple facility to assign users to different groups (so as to limit access to confidential documents or directories)?

I have Windows 10 Version 10.0.14393, Home, 64-bit, Build 14393, updates having been plugged in automatically whenever issued.

I have been looking around for some sort of help on getting to this function, and I found one route which seemed likely:
Run > lusrmgr.msc
But on going for this, I get a screen up which tells me nothing except:
” X Local Users and Groups
This snapin may not be used with this edition of Windows 10. To manage
user accounts for this computer, use the User Accounts tool in the Control Panel.”
But that tool does not give me any way to manage the groups that my users may be in-
in fact, only to switch ‘Account Type’ between ‘Standard’and ‘Administrator’.

Approaching it from a different angle: if I right-click on a particular file or folder, and pick ‘Properties’, and click on the ‘Security’ tab, then I am shown a list of 4 “Group or user names” – Authenticated Users / SYSTEM / Administrators / Users – for each of which I can edit the permissions. But, if I want to assign higher level of access to the encouragingly-named Authenticated Users, I seem to have no way to switch a particular user account into Authenticated Users – only to/from Administrators/Users. So why does the Authenticated Users class even exist?
It appears that the only way to protect confidential documents is to assign all users who are to access them to the Administrators class – which, as a matter of principle, is a trifle undesirable – and then batten down permissions for Users.

Why.
What in the name of all that’s even holier than Bill Gates is Microsoft up to here?
How can you possibly justify denying this basic function to people who have bought your OS in good faith??