chapter 5: configuring users and groups. windows vista user accounts user accounts are the primary...
Post on 21-Dec-2015
242 views
TRANSCRIPT
Chapter 5: Configuring Users and Groups
Windows Vista User Accounts
• User accounts are the primary means of authentication
• Built-in Accounts– Administrator: Full Access
• Disabled by Default– Guest: Allows access to a user who does
not have their own unique account• Disabled by Default
– Initial User: Registered User• Administrators Group
• There are 2 Account Types– Administrator– Standard
2/11
Types of User Accounts• Administrator
– Unrestricted access to performing administrative tasks
– Use sparingly
• Standard User– Can perform most day-to-day
tasks– Administrative credentials required
to make system-wide changes– Reduced the risk of viruses and
malware
3/11
Local and Domain User Accounts
• Windows Vista supports two kinds of user authentication– Local
• Stored on the local computer• Must be configured on each
computer on the network
– Domain• Active Directory is a directory service
available in Windows Server• Centralized database for User
Accounts that will login on member workstations.
4/11
Logging on to Windows Vista
• Before a user can use a Windows Vista computer, he/she must authenticate by providing a Username and Password that match what’s in the Local Security Database
5/11
Logging on to Windows Vista
• If the username and password matches the database, then an access token is issued.
• Access tokens identify the user and groups of which the user is a member
• If the group membership changes than the user must logoff and log on again to update the access token
6/11
Working with User Accounts
• Use the Local Users and Groups snap-in in the MMC – Microsoft Management Console
• Manage Local Users and Groups through the Computer Management utility
• Start>Control Panel>User Accounts and Family Safety– You can also configure Parental
Controls from here77/11
Working with User Accounts
• Use the Local Users and Groups snap-in in the MMC – Microsoft Management Console
88/11
Creating New Users
• Rules– Usernames must be between 1 and 20
characters– Usernames must be unique among all user and
group names stored on your computer– Usernames can’t contain the following
characters:
– Usernames can’t consist of only periods or spaces
• Conventions– Keeping Rules in mind, choose a consistent
naming format, i.e. First Initial + Last Name• Usernames are not case sensitive
9/11
Creating New Users
• Usernames and Security Identifiers– When you create a new user, a
security identifier (SID) is automatically created on the computer for the user account.
– The username is a property of the SID
10/11
Options for New User Accounts
11/11
Disabling and Deleting User Accounts
• Accounts that are not in use should be disabled or deleted
• Why disable?– User on vacation– User left job, job will be filled again soon
• Why delete?– User of account left long ago, has been unused
since then
• Why not delete?– Deleting an account destroys its SID, and loses
any permissions assigned to it
12/11
Renaming Users and Changing a User’s Password
• When you hire a new person into the position vacated by a former employee, rename the user account, change the password, and re-enable the account. This preserves the SID, and the new employee has all the rights and permissions granted to the former one.
• To rename, highlight the User account in Local Users and Groups, click the Action button, and choose Rename.
• To change a password, highlight the User account in Local Users and Groups, click the Action button, and choose Set Password.– Usernames are not case sensitive, but
passwords are.
13/11
Managing User Properties
14/11
Setting Up User Profiles, Logon Scripts, and Home Folders
• Profile Path: Storage place for user environment settings for a specific user– Such as desktop arrangement, program
groups, and screen colors– Local, Roaming, Mandatory
• Local is a profile on the individual computer• Roaming resides on a network server• Mandatory can not be edited by the user.
Must be edited by a member of the administrator group
• Can be created for a single user or a group
15/11
Setting Up User Profiles, Logon Scripts, and Home Folders
• Logon Script: Set up drive mappings or printer mappings, or run executables at every logon time
• Home Folders: Where users store personal files and folders– UNC (Universal Naming Conventions)
to a Share• \\Sales\Users\Will
– Server=Sales– Folder=\Users\Will– Can use the variable %username
%16/11
Managing User Properties
• Managing Group Membership
17/11
Groups
• Groups are the primary means for an administrator to control access rights to users of similar access needs.
• There are various Built-in default groups that can be used.
• Create your own Groups.
18/11
Built-in Groups• Examples of Built-in default groups that can be
used– Administrators
• Full Permissions and Privileges– Backup Operators
• Full Access to the file system only when using the Backup utility
– Remote Desktop• Allows members to login remotely for the
purpose of using the Remote Desktop utility– Network Config Group
• Can edit the systems TCP/IP setting, as well as all other network properties
– Power Users (XP backward compatibility)• From XP to Vista upgrade
– User (Limited Access) 19/11
Creating Groups
• Group name should be descriptive (ex. Account Data Users)
• Group name must be unique to the computer
• Group names can be up to 256 characters
• Users can be members of multiple groups
20/11