1. Creating and Managing User Accounts

2. Overview Introduction to User Accounts Guidelines for New User Accounts Creating Local User Accounts Creating and Configuring Domain User Accounts Setting Properties for Domain User Accounts Customizing User Settings with User Profiles Best Practices

3. Introduction to User Accounts Domain User Accounts Enable users to log on to the domain to gain access to network resources Reside in Active Directory Enable users to log on to the domain to gain access to network resources Reside in Active Directory Local User Accounts Enable users to log on and access resources on a specific computer Reside in SAM Enable users to log on and access resources on a specific computer Reside in SAM Built-in User Accounts Enable users to perform administrative tasks or gain temporary access to network resources Reside in SAM (local built-in user accounts) Reside in Active Directory (domain built-in user accounts) Enable users to perform administrative tasks or gain temporary access to network resources Reside in SAM (local built-in user accounts) Reside in Active Directory (domain built-in user accounts) Administrator and Guest

4.  Guidelines for New User Accounts Naming Conventions Password Guidelines Account Options

5. Naming Conventions User Logon Names and Full Names Must Be Unique User Logon Names: Can contain up to 20 characters Can include a combination of special alphanumeric characters A Naming Convention Should: Accommodates duplicate employee names Identifies temporary employees

6. Password Guidelines Assign a Password for the Administrator Account Determine Who Has Control over Passwords Educate Users on How to Use Passwords Avoid obvious associations, such as a family name Use long passwords Use a combination of uppercase and lowercase characters

7. Account Options Set Logon Hours to Match Users’ Work Hours Specify the Computers from Which a User Can Log On Domain users can log on at any computer in the domain, by default Domain users can be restricted to specific computers to increase security Specify When a User Account Expires

8. Creating Local User Accounts Created on Computers Running Windows 2000 Professional Created on Stand- alone or Member Servers Running Windows 2000 Server or Windows 2000 Advanced Server Reside in SAM New User User name: JYoung Full name: Description: Jonathan Young Password: ********** Confirm: ********** User must change password at next logon User cannot change password Password never expires Account is disabled Close Create Local User Accounts Are:

9.  Creating and Configuring Domain User Accounts Installing Windows 2000 Administration Tools Creating a Domain User Account Setting Password Requirements Managing User Data by Creating Home Folders

10. Setup options Select the action you want the Setup Wizard to perform. Uninstall the Administrative Tools Click an option and then click Next. Install all of the Administrative Tools Description Install / Reinstall all components of the Windows 2000 Administration Tools. Windows 2000 Administration Tools Setup Wizard < Back Active Directory Domains and Trusts Active Directory Sites and Services Active Directory Users and Computers Component Services Component Management Configure your Sever Data Sources (ODBC) DHCP Distributed File System DNS Domain Controller Security Policy Domain Security Policy Event Viewer Internet Services Manager Licensing Local Security Policy Performance Routing and Remote Access Server Extensions Administrator Services Telnet Server Administration Installing Windows 2000 Administration Tools The tools appear on the Administrative Tools menu After you install Administration Tools, use the runas command to run the tools The tools appear on the Administrative Tools menu After you install Administration Tools, use the runas command to run the tools

11. Creating a Domain User Account Console Active Directory Users and Computers WindowHelp ActionView Tree NameTypeDescription Users 20 objects Active Directory Users and Comp nwtraders.msft Builtin Computers Domain Controllers ForeignSecurityPrincipals LostAndFound System Users Administrator Cert Publishers DNSAdmins DNSUpdateProxy Domain Admins Domain Computers Domain Controllers Domain Guests User Security Group - Global Security Group - Domain Local Security Group - Global Built-in account Enterprise certi DNS clients who Designated adm All workstations All domain cont All domain gues DNS Administra Find… New All Tasks View New Window from Here Refresh Export List… Properties Help Computer Contact Group Printer Shared Folder User Create in: nwtraders.msft/Users First name: Last name: Full name: Judy Lew Judy A. Lew Initials:A User logon name: judy1@nwtraders.msft User logon name (pre-Windows 2000): NWTRADERS\ judy1 < Back Next >Cancel Delegate Control… New Object - User

12. Setting Password Requirements New Object - User Create in: nwtraders.msft/Users Password: Confirm Password: < BackNext >Cancel User must change password at next logon User cannot change password Password never expires Account is disabled ********

13. Managing User Data by Creating Home Folders Consider the Following When You Create a Home Folder: Backup and restore capability Sufficient space on the server Sufficient space on users’ computers Network performance To Create a Home Folder: 1. Create a shared folder on a server 2. Assign the appropriate permission 3. Provide a path for the user account \Home User1 User2 User3

14.  Setting Properties for Domain User Accounts Setting Personal Properties Setting Account Properties Specifying Logon Options Copying Domain User Accounts Creating User Account Templates

15. Setting Personal Properties Active Directory Add Personal Information About Users As Stored in Active Directory Use Personal Properties to Search Active Directory Student 01 Properties Remote control User01 Terminal Services Profile Member OfDial-inEnvironmentSessions General AddressAccountProfile Telephones Organization

16. Setting Account Properties User02 User User03User User04User User05User User06User User01User Use 01 Properties Remote control Terminal Services Profile Member OfDial-inEnvironmentSessions General Address AccountProfile Telephones Organization @nwtraders.msft User01 User logon name: User logon name (pre-Windows 2000): NWTRADERS\ Account is locked out Logon Hours… Student01 Log On To… Account options: User must change password at next logon User cannot change password Password never expires Store password using reversible encryption Account expires: Never End of: Wednesday, November 24, 1999 OKCancel Apply Copy… Add members to a group…… Reset Password… Disable Account Move… Open home page Send mail Delete Rename Refresh Properties Help

17. Specifying Logon Options Logon Hours for User01 OK Cancel 12 2468102468............ Logon Permitted Logon Denied All Sunday Monday Tuesday Wednesday Thursday Friday Saturday Default Default Logon Workstations This feature requires the NetBIOS protocol. In Computer name, type the pre-Windows 2000 computer name. This user can log on to: All computers The following computers Computer name: Brisbane Perth OKCancel Add Edit Remove

18. Copying Domain User Accounts Copy an Existing Domain User Account to Simplify the Process of Creating a New Domain User Account. Domain User Account (User1) Domain User Account (User2) CopyCopy Domain User2 Domain User1

19. Creating User Account Templates Console Active Directory Users and Computers WindowHelp ActionView Tree NameTypeDescription Users 28 objects Active Directory Users and Compu nwtraders.msft Builtin Casablanca Computers Denver OU Domain Controllers ForeignSecurityPrincipals Administrator Cert Publishers DHCP Administrators DHCP Users DnsAdmins DnsUpdateProxy Domain Admins Domain Computers ount f certifi o hav strato who Users Portland Seattle StudentOU Tunis Vancouver OU Domain Controllers Domain Guests Domain Users Enterprise Admins Group 01 _Sales TemplateUser Copy… Add members to a group… Enable Account Reset Password… Move… Open home page Send mail All Tasks Delete Rename Refresh Properties Help Creates a new user, copying information from the selected user. admi ions ontro uest aser admi Copy Object - User Create in: nwtraders.msft/Users First name: Last name: Full name: sales user1 sales user1 Initials: User logon name: salesuser1@nwtraders.msft User logon name (pre-Windows 2000): NWTRADERS\ salesuser1 < Back Next >Cancel Set Up a User Account as a Template Account Create a User Account by Coping the Template Account

20.  Customizing User Settings with User Profiles User Profile Types Creating Roaming and Mandatory Roaming User Profiles

21. User Profile Types Default User Profile Serves as the bases for all user profiles Local User Profile Created the First Time a User Logs on to a Computer Stored on a Computer's Local Hard Disk Default User Profile Serves as the bases for all user profiles Local User Profile Created the First Time a User Logs on to a Computer Stored on a Computer's Local Hard Disk User Profile User Profile Display Regional Settings Regional Settings Mouse Sounds Modify Save Roaming User Profile Created by the System Administrator Stored on a server Mandatory User Profile Created by the System Administrator Stored on a server Roaming User Profile Created by the System Administrator Stored on a server Mandatory User Profile Created by the System Administrator Stored on a server Profile Windows 2000 Client Windows 2000 Client Windows 2000 Client Windows 2000 Client Windows 2000 Client Windows 2000 Client Profile Server Display Regional Settings Regional Settings Mouse Sounds

22. Creating Roaming and Mandatory Roaming User Profiles Create a Roaming User Profile Create a Shared Folder on the Server Set Up a Configured Roaming User Profile Specify the Shared Folder in Path Information Create a Mandatory User Profile Create a Shared Folder on the Server with a User Profile Folder Inside Rename Ntuser.dat to Ntuser.man

23. Best Practices Rename the Administrator Account Create a User Account with Administrative Rights Create a User Account for Non-Administrative Tasks Enable the Guest Account Only in Low Security Networks Create Random Initial Passwords Require New Users to Change Their Passwords Set Account Expiration Dates for Temporary Employees

24. Review Introduction to User Accounts Guidelines for New User Accounts Creating Local User Accounts Creating and Configuring Domain User Accounts Setting Properties for Domain User Accounts Customizing User Settings with User Profiles Best Practices