Some overlap exists between the settings of the MMC and the settings of the registry. The MMC is extensible. Policies and properties can be edited via the Microsoft Management Console (MMC).

general security controls audit user rights password policies accounts lockout digital certificate management Kerberos public-key policies IPSec policies both local and Active-X user policies device management etc. etc. etc.

The MMC is a framework. Using the MMC requires snap-ins. File > Add/Remove Snap-ins

ActiveX Control  manage domain users Certificates  manage digital certificates for users, computers, and/or services Computer Management  manage local/remote computers  includes elements of other snap-ins (event logs, shared folders local users & groups, performance logs Local Users & Groups  create/modify local accounts  disable local accounts  set password expiration parameters  create/modify/delete local groups  assign local user(s) to groups

Device Manager Disk Defragmenter  analyze/defragment secondary storage volumes (a utility) Disk Management  view/configure partitions  format drives and assign drive letters Event Viewer  view application, security and/or system logs  troubleshoot local hardware  install/update device drivers  view/configure various hardware parameters Group Policy  apply policy settings to computers, users and/or groups

IP Security Policy Management  manage various policies associated with IP (e.g. authenticated protocols) Local Users and Groups  create/modify/delete local users and/or groups  create/modify user/group profiles Performance Monitor  view/manage performance logs Resultant Set of Policy  view policies set by selected other snap-ins Security Templates  create/modify security templates that can be applied to users Services  edit services (terminal services, telnet, smart card, RPC, net login, ICF)

 A policy is a centralized collection of operational/security controls.  Policy application is accomplished via group policy objects (GPO).  GPOs can be applied to local, site, domain, organizational unit  The last applicable GPO that is applied takes precedent.  GPOs are inherited by default.  GPO settings include no override, enable, disable, allow/deny.  Limitation: user that is a member of more than 70 to 80 groups.  EXAMPLE POLICIES  password age, complexity, size  account lockout duration  auditing of logon, directory access, processes, policy changes  user/group privileges  IPSec