Presentation is loading. Please wait.

Presentation is loading. Please wait.

Managing User, Computer and Group Accounts

Similar presentations

Presentation on theme: "Managing User, Computer and Group Accounts"— Presentation transcript:

1 Managing User, Computer and Group Accounts
Lecture 5

2 Computer Accounts To access Windows 2008 domain a computer needs an account Joining a domain creates a computer account object in the AD Each computer account has SID (other security principals, such as users and groups have SIDs as well)

3 User Accounts To access Windows 2008 network a user needs an account
Account determines 3 factors: - when a user may log on - where within the domain/workgroup - what privilege level a user is assigned

4 User Accounts Each account has SID that serves as security credentials
Any object trying to access resource must do it through a user account Windows 2008 has 2 types of accounts: local and domain

5 Interactive Logon Process
Interactive Logon – a process to verify user’s credentials for logon to a Win2008 computer If the local account – it’s checked against the local user account database. Domain account – using encryption process, user credentials are verified at a DC, and after successful authentication a logon key/logon token is granted for the session

6 Network Authentication Process
Process of verifying user’s credentials to allow access to network resources When a user attempts to access a resources, user’s credentials and session key/token are compared against resources’ ACL list to grant access

7 Local Accounts Supported on all Windows 2000, 2003 and 2008 systems except DCs (on member servers participating in domains and on standalone systems participating in workgroups ) Maintained on the local system, not distributed to other systems Local user account authenticates the user for local machine access only; access to resources on other computers is not supported Built-in local accounts: Guest; Administrator

8 Domain User Accounts Permit access throughout a domain and provide centralized user administration through AD Created within a domain container in AD database and propagated to all other DCs Once authenticated against AD database using GC, a user obtains an access token for the logon session, which determines permissions to all resources in the domain

9 Creating User Accounts
Domain accounts names must be unique within the domain, although the same logon name can be used on several systems with local logon. Logon names are not case sensitive, must not contain more than 20 chars, and nust not contain: +,*,?,<,>,/,\,[,],:,;. Passwords are case sensitive, must be secure – not easy to guess

10 Copying, Moving, Disabling and Renaming User Accounts
Renaming account doesn’t affect any of the user account properties, except the name. Accounts can be moved from one container to another Disabled accounts can’t be accessed When account is copied, most properties are copied, except the username, full name, password, logon hours, address/phone info, organization info, the Account is disabled option, and user rights and permissions.

11 Deleting User and Computer Accounts
Deleting account – permanently removes it, and all if its group memberships, permissions and user rights. The new account with the same name has different SID and GUID Disabling an account may be a better option! Administrator and Guest can be renamed, but not deleted

12 Understanding User Account Properties
As with all AD objects, user accounts have a number of associated properties or attributes Once the account is created, those properties maybe modified using Computer Management tool (local accounts) or AD Users and Computers (domain accounts)

13 Group Accounts Group – AD objects that contain users, computers and other entities. (have SIDS) Groups are used for easier management of users/computers/resources Access token identifies groups to which a users belongs/rights assigned 2 Types of groups: Distribution group for Security groups to assign limited permission to groups that need access to resources or to deny access

14 Example of Access Token

15 Group Accounts Rights and privileges are assigned at the group level
Groups can be nested (membership by inheritance) User’s rights and privileges through group memberships are cumulative

16 Group/User relationship
Group 3 is a member of Group 1 Group 2 Group 3

17 Group Scope Scope of influence (or scope)
Reach of a group for gaining access to resources in Active Directory Types of groups and associated scopes: Local Domain local Global Universal

18 Local Groups Local security group
Used to manage resources on a stand-alone computer that is not part of a domain and on member servers in a domain (non-DCs) Create using the Local Users and Groups MMC snap-in

19 Domain Local Groups Domain local security group
Used when Active Directory is deployed Manage resources in a domain Give global groups from the same and other domains access to those resources Scope of a domain local group Domain in which the group exists Can convert a domain local group to a universal group

20 Domain Local Groups

21 Domain Local Group Example
Domain C Domain B Domain A Engineering (Global Group) User 1 User 2 Printer Group (Domain Local) User 1 Engineering User 2 Printer ACL Printer Group - Print

22 Global Groups Contain user accounts from a single domain
Can also be set up as a member of a domain local group in the same or another domain Broader scope than domain local groups Can be nested Typical use: Add accounts that need access to resources in the same or in another domain Make the global group in one domain a member of a domain local group in the same or another domain

23 Nested Global Groups

24 Global Group Example Domain B Domain A Domain C Group 2 User1 Group 1
Accountants Accountants (Global Group) Domain C User 1 Group 1 Printer ACL Accountants

25 Universal Groups Universal security groups Can include
Span domains and trees Can include User accounts from any domain Global groups from any domain Other universal groups from any domain Guidelines to help simplify how you plan to use groups

26 Universal Groups

27 Group Strategy Put users into global domain group. A global group can be thought of as an Accounts group. Put resources into domain local (or machine local) groups. A local group can be thought of as a Resource group. Put a global group into any domain local (or machine local) group in the forest Assign permissions for accessing resources to the domain local (or machine local) groups that contain them Use Universal groups to grant access to resources in multi-domain environments where access is needed across domain trees.

28 Group Strategy Example
Domain B Domain A Engineers (Global Group) Engineers (Global Group) Database Access (Domain Local G.) Domain C Domain A Engineers Domain B Engineers Domain C Engineers Engineers (Global Group) ACL Database Access Allow Write/Read Database

29 Default User Account Membership
Built-in groups are automatically created in Windows Server 2003 to reflect most common attributes and tasks Domain Users/Users Domain Admins/Administrators

30 Special Groups EVERYONE Network Interactive Service System
Authenticated Users SELF CREATOR OWNER

31 User Profiles Profiles customize user environment, store profiles on server (roaming), restrict changes through mandatory profiles Local profiles are stored on a computer when each user logs in.

Download ppt "Managing User, Computer and Group Accounts"

Similar presentations

Ads by Google