Chapter 5: Configuring Users and Groups

Windows Vista User Accounts User accounts are the primary means of authentication Built-in Accounts –Administrator: Full Access Disabled by Default –Guest: Allows access to a user who does not have their own unique account Disabled by Default –Initial User: Registered User Administrators Group There are 2 Account Types –Administrator –Standard 2/11

Types of User Accounts Administrator –Unrestricted access to performing administrative tasks –Use sparingly Standard User –Can perform most day-to-day tasks –Administrative credentials required to make system-wide changes –Reduced the risk of viruses and malware 3/11

Local and Domain User Accounts Windows Vista supports two kinds of user authentication –Local Stored on the local computer Must be configured on each computer on the network –Domain Active Directory is a directory service available in Windows Server Centralized database for User Accounts that will login on member workstations. 4/11

Logging on to Windows Vista Before a user can use a Windows Vista computer, he/she must authenticate by providing a Username and Password that match what’s in the Local Security Database 5/11

Logging on to Windows Vista If the username and password matches the database, then an access token is issued. Access tokens identify the user and groups of which the user is a member If the group membership changes than the user must logoff and log on again to update the access token 6/11

Working with User Accounts Use the Local Users and Groups snap-in in the MMC – Microsoft Management Console Manage Local Users and Groups through the Computer Management utility Start>Control Panel>User Accounts and Family Safety –You can also configure Parental Controls from here 7 7/11

Working with User Accounts Use the Local Users and Groups snap-in in the MMC – Microsoft Management Console 8 8/11

Creating New Users Rules –Usernames must be between 1 and 20 characters –Usernames must be unique among all user and group names stored on your computer –Usernames can’t contain the following characters: –Usernames can’t consist of only periods or spaces Conventions –Keeping Rules in mind, choose a consistent naming format, i.e. First Initial + Last Name Usernames are not case sensitive 9/11

Creating New Users Usernames and Security Identifiers –When you create a new user, a security identifier (SID) is automatically created on the computer for the user account. –The username is a property of the SID 10/11

Options for New User Accounts 11/11

Disabling and Deleting User Accounts Accounts that are not in use should be disabled or deleted Why disable? –User on vacation –User left job, job will be filled again soon Why delete? –User of account left long ago, has been unused since then Why not delete? –Deleting an account destroys its SID, and loses any permissions assigned to it 12/11

Renaming Users and Changing a User’s Password When you hire a new person into the position vacated by a former employee, rename the user account, change the password, and re-enable the account. This preserves the SID, and the new employee has all the rights and permissions granted to the former one. To rename, highlight the User account in Local Users and Groups, click the Action button, and choose Rename. To change a password, highlight the User account in Local Users and Groups, click the Action button, and choose Set Password. –Usernames are not case sensitive, but passwords are. 13/11

Managing User Properties 14/11

Setting Up User Profiles, Logon Scripts, and Home Folders Profile Path: Storage place for user environment settings for a specific user –Such as desktop arrangement, program groups, and screen colors –Local, Roaming, Mandatory Local is a profile on the individual computer Roaming resides on a network server Mandatory can not be edited by the user. Must be edited by a member of the administrator group Can be created for a single user or a group 15/11

Setting Up User Profiles, Logon Scripts, and Home Folders Logon Script: Set up drive mappings or printer mappings, or run executables at every logon time Home Folders: Where users store personal files and folders –UNC (Universal Naming Conventions) to a Share \\Sales\Users\Will –Server=Sales –Folder=\Users\Will –Can use the variable %username% 16/11

Managing User Properties Managing Group Membership 17/11

Groups Groups are the primary means for an administrator to control access rights to users of similar access needs. There are various Built-in default groups that can be used. Create your own Groups. 18/11

Built-in Groups Examples of Built-in default groups that can be used –Administrators Full Permissions and Privileges –Backup Operators Full Access to the file system only when using the Backup utility –Remote Desktop Allows members to login remotely for the purpose of using the Remote Desktop utility –Network Config Group Can edit the systems TCP/IP setting, as well as all other network properties –Power Users (XP backward compatibility) From XP to Vista upgrade –User (Limited Access) 19/11

Creating Groups Group name should be descriptive (ex. Account Data Users) Group name must be unique to the computer Group names can be up to 256 characters Users can be members of multiple groups 20/11