CHAPTER 5 MANAGING USER ACCOUNTS & GROUPS

User Accounts Windows 95, 98 & Me do not need a user account like Windows XP Professional to access computer. Separate account allows each user to have their own document folders & setting such as theme etc. User account in XP = profile that defines user rights, customizations & settings. User account properties ◦ Access rights ◦ Desktop layout ◦ Individual user favorite & history ◦ User of private ‘My Documents’ folder

Types of User Accounts A user account define the actions a user can perform in Windows XP. User accounts provide the facility to maintain individual Windows XP settings, preferences, secure documents & files. 3 types of user accounts: ◦ Local-user account ◦ Built-in user account ◦ Domain user account

Local user account Allows user to log on to a specific computer & access resources on that computer. Local user account information resides on a local computer & verifies locally during login process. Only resources available to a local machine on which the user account exist can be accessed. When you create a local user account, Windows XP creates a local security database on that computer & uses this local security database to authenticate users during log on process. Properties of Local User account: ◦ Provide access to resources on local computer ◦ Are created only on computers that are not in a domain ◦ Are created in the local security database.

Built-in user account Each account has a different set of account rights. Windows XP Professional 3 built-in account types are: ◦ Administrator User Account ◦ Limited User Account ◦ Guest User Account

Built-in user account Administrator User Account ◦ Only administrator account have full system access including access to other user account. ◦ Usually created during Windows XP installation & responsible for maintaining all other user accounts & system resources. ◦ Rights of an administrator user account:  Can install software & hardware  Can create, modify & delete user accounts  Access all files & programs  Create / change passwords for all user accounts  Modify names, pictures & account types of all users  Full access of system hardware & software

Limited User Account Created for regular users of the computer. Administrator is also suggested to create a user account & only use administrative account for system maintenance purpose. Rights of Limited User Account: ◦ Allowed access to already installed software ◦ Can modify own user account with exception of account name / type ◦ Do not have rights to install software / hardware ◦ Allowed to create files in the Shared Document Folder ◦ Can change your desktop theme, wallpaper & screensaver

Guest User Account Used when someone needs to access the computer for a short period of time – such as temporary staff. Guest account can only be activated by the administrator before it can be used. Rights of a Guest User Account: ◦ Do not have rights to install software / hardware ◦ Can not modify guest account / profile

Domain User Account Allows you to log on to the domain & access resources anywhere on the network. When log on, user to provide login username, password & domain name. Domain controller is a server machine which uses this logon information to authenticate user’s identity & built user preference & security settings. Domain user account information resides on domain controller ( can login on any computer as long as its part of the domain). What a domain user account can do: ◦ Provide access to network resources ◦ Provide access to server (domain controller) & its resources ◦ Allowed to access any resources on other computers which are part of the domain.

Password guidelines Determine whether Administrator or the users will control passwords (strong password policy) Use passwords that are hard to guess. Using a common dictionary word makes you vulnerable to automated programs designed to guess passwords Using any password that you can write down / share with someone else is not secure Can contain up to 128 characters, min length 8 characters (avoid anything shorter) Include both uppercase & lowercase letters, numerals& the valid non-alphanumeric characters Using no password at all is not a good practice Combining symbols like or spaces are allowed) to make passwords more secure. Change passwords regularly.

User profile Whenever you create a user account, Windows machine will create a profile called user profile. These is where information of the user is along with the chosen personalization. User profile contains: desktop icons, shortcuts, personalized start menu, files & folders, network settings, desktop setting, printer definitions. All these settings are stored in registry under NTUSER.DAT file.

Groups Every local user account of Windows XP Professional belongs to one or more local user groups. A set of users can be put in a group who shares similar rights & control over Windows XP machine. Properties of a Group: ◦ Groups are collections of user accounts. ◦ Members of same group have similar permissions & rights. ◦ A single user can be a member of multiple groups. ◦ Groups, itself can become a members of other groups ◦ Groups help in controlling & managing computer resources over a network.

Groups Windows XP Professional has four primary user groups. They are: ◦ Administrator ◦ Power users ◦ Users ◦ Guests

Administrator Group Have the largest amount of default permissions & rights. Among the rights are: ◦ Install the operating system & components ◦ Install service packs & window packs ◦ Upgrade the operating system ◦ Repair the operating system ◦ Configure critical operating system parameters ◦ Take ownership of files that have become inaccessible ◦ Managing the security & auditing logs ◦ Back-up & restore the system

Power User Group Have less permissions than Administrative group but more than User group. They cant modify any properties of Administrator group. Rights of power user group: ◦ Run legacy applications, in addition to Windows XP Pro certified applications. ◦ Install programs that do not modify OS files / install system service ◦ Customize system wide resources including printers, date, time, power options & other control panel resources ◦ Create & manage local user accounts & groups ◦ Stop & start system services which are not started by default.

Users Group Tasks that can be done include running applications, using local & network printers, shutting down & locking the workstation, create local groups. Most secure as they can not modify the OS Rights of user groups: ◦ Cannot modify system wide registry settings, OS files or program files ◦ Can shutdown workstations but not the servers ◦ Can create local groups & manage only those they created ◦ Have full control over all of their own data files located in user profile. ◦ Can run certifies Windows XP programs that have been installed by Administrators

Guests Group Intended for those users who don’t have user account on the computer. No password, so user can login quickly Rights of guest group: ◦ Cannot install software / hardware but can access all installed programs ◦ Cannot change the properties of guest account type ◦ Can change the own guest account picture.