http://www.microsoft.com/windows2000/techinfo/planning/security/secdefs.asp contains:
This white paper describes the default security settings for components of the Windows® 2000 operating system including the registry and file system, as well as user rights and group membership. Implications for developers and system administrators are discussed, and answers to frequently asked questions are provided.
A significant portion of Windows® 2000 operating system security is defined by the default access permissions granted to three groups: Administrators, Users, and Power Users. At a very high level, these groups may be described as follows:
Administrators are all-powerful. The default Windows 2000 security settings do not restrict administrative access to any registry or file system object. Administrators can perform any and all functions supported by the operating system. Any right that the Administrator does not have by default, they can grant to themselves.
Users are the opposite of administrators. Provided that Windows 2000 is clean-installed on to an NTFS partition, the default security settings are designed to prohibit Users from compromising the integrity of the operating system and installed applications. Users cannot modify machine-wide registry settings, operating system files, or program files. Users cannot install applications that can be run by other Users (preventing Trojan horses). Users cannot access other users’ private data.
Power Users are ranked between Administrators and Users in terms of system access. The default Windows 2000 security settings for Power Users are backward-compatible with the default security settings for Users in the Windows NT® 4.0 operating system.
