How might it be possible to create an administrator account in Windows XP SP2 from a limited account? I heard it was possible.

Also, what abilities to administrator account holders have. I have an administrator account and if someone set up another account of this type what could they do to the files, settings etc. in my account? I'm just worried about the safety of my files and privacy in general.

Thanks

Thanks for the reponses so far. Someone else who uses this computer managed to somehow create an admin account and it seems I have the ability as the user of such an account to change their password, delete account, change account type etc. I'm worried the holder of that account would be able to do that to mine.

I won't screw with their account because of moral reasons but I can't say I fully trust them and that makes me nervous. But is it possible the new account holder managed to acquire my password?

/laughs. Well that is one of the reasons.

Thanks Crono but in Control Panel > User Accounts > [other persons account] > Change the account type, there are only 2 options - Computer administrator and Limited. How do I access the 3rd type you mentioned?

For what people (in a list of me and the other guy) should the accounts type (including the 3rd type) be set to (bearing in mind I have absolutely no interest in other peoples private files etc. but am paranoid about my own)?

How was this other guy able to set up their admin account from a limited? If they got my password, they could get my password again if I changed it.

Thanks again for everyones help so far.

Well what happened was at the start of the year, I thought it was best to set up an account of my own to protect my files. I passworded said account and made it an administrator account. I then changed the default "Owner" account to limited (but left it without a password) to try to prevent anyone from resetting my password or just maliciously delete the account with my name on it. This has failed as someone accessing the limited "Owner" account managed to create another admin account, passworded it and named it leaving me concerned. It is very unlikely said party managed to guess my password so I'm completely stumped.

Any ideas?