What rights does the extender have to have to operate. My daughter is starting to use MCE and I wanted to lock down the extender so she cannot delete anything by accident. When I went into the MCX user account I noticed that it was part of the administrator group. I took the user out of the group and now my extender is not communicating. Does anyone know what rights the MCX account has to have.

By the way I have Vista MCE and DMA2200

I believe each time you setup an extender is creates the MCX(+) account (+ 1 for the first, 2 for the second).  If you delete the user, your extender will not communicate to the host and will need to be setup again.  Once done, the user account will appear again.  I don't know how to limit the delete option.

---

----------------------------------------------------------
Asus P5E-VM HDMI (onboard audio/video), Core 2 Duo E8200, 4 GB RAM, Hauppauge HVR-1800 (x2), LG-GGC H20L, DMA-2100 (x4), Yamaha RX-N600, InFocus IN76, D-LINK DIR 655, Vista Ultimate

To answer the original question:
The MCXx account(s) need everything except "delete" permissions on any directories that you want it/them to access.
Also, do not modify the account itself in any way, or you'll break it (as you found.) 
Instead, lock the account down in your directory permissions.

---

~Chris
'nearly every day of my life is some kind of computer hell'

Desktop: Shuttle SN41 (AthlonXP 2700+), AIW, T550, PVR-USB2, HDHR; server: Intel E6400 on I965P mobo, 2GB RAM, 2x 500GB WD, PVR500, NV DualTV, Saber2020, 2xHDHR; Xbox MCX, Xbox360

I think what he's getting at is what privileges do the extenders need to have, not just permissions on folders. In other words, why are they added to the Administrators group rather than say a new group called Media Center Extender Accounts and system privileges and permissions granted accordingly.

@ the OP - since all you did was change group membership, that's obviously an easy fix. I haven't tried this, but you may want to try creating your own group and adding the MCX accounts to it and granting file/folder permissions as needed to the group rather than allowing the accounts complete control to your computer.

@ the PP - "locking down the account" means a lot more than just restricting permissions to a file / folder; it means constrainting system privileges which, by being a member of the Administrators group, is far from doing and for that matter...granting permissions on files & folders is irrelevant in that case since the accounts can access everything on the system

Then again, if it's just in a home environment, and you're effectively hidden through routers, firewalls and so on...is it that paramount? ;)

 

@ the OP again...I'll probably need to crack open a book to verify the way NTFS calculates ACLs, but I'm pretty sure that if there's a DENY in the ACE list, then that will be evaluated first and it won't matter if the user's in the Admin group or not. With that being the case, you could *try* to deny the Modify permission on a folder to the MCXn account and that should cover you...but that could cause other issues as well potentially.