Download
70 270 mcse guide to microsoft windows xp professional chapter 5 users groups profiles and policies n.
Skip this Video
Loading SlideShow in 5 Seconds..
70-270: MCSE Guide to Microsoft Windows XP Professional Chapter 5: Users, Groups, Profiles, and Policies PowerPoint Presentation
Download Presentation
70-270: MCSE Guide to Microsoft Windows XP Professional Chapter 5: Users, Groups, Profiles, and Policies

70-270: MCSE Guide to Microsoft Windows XP Professional Chapter 5: Users, Groups, Profiles, and Policies

170 Views Download Presentation
Download Presentation

70-270: MCSE Guide to Microsoft Windows XP Professional Chapter 5: Users, Groups, Profiles, and Policies

- - - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript

  1. 70-270: MCSE Guide to Microsoft Windows XP ProfessionalChapter 5: Users, Groups, Profiles, and Policies

  2. Objectives • Understand Windows XP Professional user accounts • Understand the different types of logons • Understand how to log on to Windows XP • Understand naming conventions • Create and manage local user accounts • Planning groups and system groups 70-270: MCSE Guide to Microsoft Windows XP Professional

  3. Objectives (continue) • Work with Windows XP as a domain client • Create user profiles • Work with group policies • Troubleshoot cached credentials • Understand the Files and Settings Transfer Wizard and the User State Migration Tool (USMT) 70-270: MCSE Guide to Microsoft Windows XP Professional

  4. Windows XP Professional User Accounts • Designed for use as a network client for: • Windows NT • Windows 2000 • Windows Server 2003 • Member of a workgroup • Standalone operating system 70-270: MCSE Guide to Microsoft Windows XP Professional

  5. Types of Windows XP Professional User Accounts • Local user account • Exists on a single computer • No domain access • Domain user account • Exists throughout a domain • Can be used on any domain member computer 70-270: MCSE Guide to Microsoft Windows XP Professional

  6. How Accounts Interact with a Windows XP Professional System • Standalone system, automatic logon • Standalone system • Workgroup member • Domain network client 70-270: MCSE Guide to Microsoft Windows XP Professional

  7. Supporting More Than One User • Multiple-user systems • Implemented through: • Groups • Resources • Policies • Profiles 70-270: MCSE Guide to Microsoft Windows XP Professional

  8. Types of Logon • Logon authentication has two purposes: • Maintain security • Track computer usage 70-270: MCSE Guide to Microsoft Windows XP Professional

  9. Windows Welcome Logon Method • Completely new logon method • Designed for use on standalone or workgroup member systems • List of user accounts with icons • Fast User Switching, • Switch users without logoff 70-270: MCSE Guide to Microsoft Windows XP Professional

  10. Classic Logon Method • Press Ctrl+Alt+Delete to access WinLogon security dialog box • Required for domain member systems 70-270: MCSE Guide to Microsoft Windows XP Professional

  11. Logging On to Windows XP • XP automatically creates accounts • Administrator • Guest 70-270: MCSE Guide to Microsoft Windows XP Professional

  12. Administrator • Most powerful user account possible • Unlimited access and unrestricted privileges • Must be protected from misuse • Complicated password should be used • Should rename this account 70-270: MCSE Guide to Microsoft Windows XP Professional

  13. Administrator (continued) • Characteristics: • Cannot be deleted • Cannot be locked out • Can be disabled • Can have a blank password (however, this is not recommended) • Can be renamed (which is recommended) • Cannot be removed from the Administrators local group 70-270: MCSE Guide to Microsoft Windows XP Professional

  14. Guest • One of the least privileged user accounts • Limited access to resources and computer activities • Should rename account • Member of the Everyone group • Recommended to leave the Guest account disabled 70-270: MCSE Guide to Microsoft Windows XP Professional

  15. Guest (continued) • Characteristics: • Cannot be deleted • Can be locked out • Can be disabled (it is disabled by default) • Can have a blank password (it is blank by default) • Can be renamed (which is recommended) • Can be removed from the Guests local group 70-270: MCSE Guide to Microsoft Windows XP Professional

  16. Naming Conventions • Predetermined process for creating names on network or standalone system • Should incorporate a scheme for: • User accounts • Computers • Directories • Network shares • Printers • Servers 70-270: MCSE Guide to Microsoft Windows XP Professional

  17. Managing Local User Accounts • Two types: • Local representations of domain/network user accounts • Created from scratch locally • User Accounts applet • Used to create local representation • Local Users and Groups snap-in • Used to create accounts from scratch 70-270: MCSE Guide to Microsoft Windows XP Professional

  18. User Accounts Applet • Users tab • Lists active users • Add New User wizard to add users • Advanced tab • Access to • Password and passport management • Advanced user management • Secure logon settings 70-270: MCSE Guide to Microsoft Windows XP Professional

  19. Local Users and Groups • Create and manage local users • Console tree nodes: • Users • Groups 70-270: MCSE Guide to Microsoft Windows XP Professional

  20. Planning Groups and System Groups • Plan how to manage groups • Pair groups with resources for administrative control • Ongoing administrative task: • Adding and removing users from groups 70-270: MCSE Guide to Microsoft Windows XP Professional

  21. Working with Groups You’ve Made • Must have a Windows NT, 2000, or Server 2003 in client/server environment • Resource • Has local groups assigned to it • Global user groups • Assigned to local resource groups • Users • Assigned to global groups 70-270: MCSE Guide to Microsoft Windows XP Professional

  22. Assigning users access to resources using groups 70-270: MCSE Guide to Microsoft Windows XP Professional

  23. Working with Default Groups • Administrators • Backup Operators • Guests • Network Configuration Operators • Power Users 70-270: MCSE Guide to Microsoft Windows XP Professional

  24. Working with Default Groups (continued) • Remote Desktop Users • Replicator • Users • HelpServicesGroup 70-270: MCSE Guide to Microsoft Windows XP Professional

  25. Working with System Groups and Other Important Groups • Built-in system-controlled groups • Preexisting groups • Cannot be edited • Used by system to control or place restrictions on specific groups of users based on activities 70-270: MCSE Guide to Microsoft Windows XP Professional

  26. Windows XP as a Domain Client • Can serve as a client to an Active Directory domain • Centralized control of user accounts and overall security • Resources centrally located • Management of access easier than a workgroup network 70-270: MCSE Guide to Microsoft Windows XP Professional

  27. Adding a System as a Domain Client • Add a Windows XP Professional system as a client in domain network: • Administrator creates computer account in the domain • Computer account in the domain is generated from the client • Remove a client from a domain: • Join a workgroup 70-270: MCSE Guide to Microsoft Windows XP Professional

  28. Controlling a Domain Client • Domain enforces control using group policy objects (GPOs) • GPOs • Registry templates • Forced onto a system each time it starts or each time a user logs on • Domain-level version of the local security policy 70-270: MCSE Guide to Microsoft Windows XP Professional

  29. Access to Systems and Resources by a Domain Client • Only members of domain can access systems and resources within domain • Resources accessed through My Network Places 70-270: MCSE Guide to Microsoft Windows XP Professional

  30. Group Types assigned by a Domain Client • Administrators • Backup Operators • Guests • HelpServicesGroup • Network Configuration Operators 70-270: MCSE Guide to Microsoft Windows XP Professional

  31. Group Types assigned by a Domain Client (continued) • Power Users • Remote Desktop Users • Replicator • Users 70-270: MCSE Guide to Microsoft Windows XP Professional

  32. Active Directory Domain Containers • Active Directory domain containers: • Logical: • Domain • Organizational Unit (OU) • Physical: • Site 70-270: MCSE Guide to Microsoft Windows XP Professional

  33. User Profiles • Collection of desktop and environmental configurations • Computer maintains profile for each user • Material such as: • Application data • My Documents • Cookies • Etc. 70-270: MCSE Guide to Microsoft Windows XP Professional

  34. Local Profiles • Set of specifications and preferences • For an individual user • Stored on local machine • Reside in the %username% subdirectory beneath the \Documents and Settings directory • Set up by example • Saved on logout 70-270: MCSE Guide to Microsoft Windows XP Professional

  35. Roaming Profiles • Resides on a network server • Automatically downloaded to any system when user logs on • Default path designation: • \\computername\username 70-270: MCSE Guide to Microsoft Windows XP Professional

  36. Application of Group Policies • Several security and access controls • Group policies (GPOs) can be defined for: • Domain • Sites • Organizational units (OUs) • Local computer group policy managed from a Windows XP Professional system • Policies applied in order: • LSDOU (local, site, domain, organizational unit) 70-270: MCSE Guide to Microsoft Windows XP Professional

  37. Password Policy • Defines the restrictions on passwords • Includes password age, length, etc. 70-270: MCSE Guide to Microsoft Windows XP Professional

  38. Account Lockout Policy • Conditions that result when a user account is locked out • Used to prevent brute force attacks against user accounts • Items: • Account lockout threshold • Account lockout duration • Reset account lockout counter after 70-270: MCSE Guide to Microsoft Windows XP Professional

  39. Audit Policy • Defines events recorded in Security log of Event Viewer • Used to track resource usage • Items (not full list): • Audit directory service access • Audit logon events • Audit account logon events • Audit system events 70-270: MCSE Guide to Microsoft Windows XP Professional

  40. User Rights Assignment • Defines which groups or users can perform the specific privileged action • Items (not full list): • Access this computer from the network • Back up files and directories • Change the system time • Load and unload device drivers • Profile single process • Shut down the system 70-270: MCSE Guide to Microsoft Windows XP Professional

  41. Security Options • Controls various security features, functions, and controls of environment • Items (not full list): • Accounts • Devices • Domain member • Microsoft network server 70-270: MCSE Guide to Microsoft Windows XP Professional

  42. Group Policies • Domain-level version of the local security policy • Two primary divisions: • Computer Configuration • User Configuration 70-270: MCSE Guide to Microsoft Windows XP Professional

  43. Troubleshooting Cached Credentials • Automatically caches user’s credentials in the Registry • When domain logon or .NET Passport logon is performed • Can be disabled: • Enable the group policy setting of Interactive logon • Set the cachedlogonscount Registry value to 0 70-270: MCSE Guide to Microsoft Windows XP Professional

  44. Files and Settings Transfer Wizard • Move data files and personal desktop settings from another computer to new Windows XP Professional system • Must have some sort of network connection between the two systems • Transfer files from Windows 95, 98, SE, Me, NT, 2000, or XP systems • Transfer process can take considerable time 70-270: MCSE Guide to Microsoft Windows XP Professional

  45. User State Migration Tool (USMT) • Supports migration to user data from Windows 9x, Windows NT Workstation 4.0, and Windows 2000 Professional to a Windows XP Professional system • Able to transfer the same files and settings that the Files and Settings Transfer Wizard can • Fully configurable and scriptable 70-270: MCSE Guide to Microsoft Windows XP Professional

  46. User State Migration Tool (USMT) (continued) • Two command-line utilities: • ScanState • LoadState • Read instructions and control parameters from INF files • ScanState • Used to create a backup of the user data • LoadState • Used to copy the data onto new target system 70-270: MCSE Guide to Microsoft Windows XP Professional

  47. Summary • Three types of users: • Locally created users • Imported users • Domain users • Users are collected into groups • Simplifies management and grant access or privileges • There are two built-in users, Administrator and Guest, and several built-in groups • Profiles can be local or roaming 70-270: MCSE Guide to Microsoft Windows XP Professional

  48. Summary (continued) • Group policies are domain-level versions of the local security policy. • The Files and Settings Transfer Wizard • Used to move data files and personal desktop settings from one system to another. • The User State Migration Tool • Used for enterprise migrations 70-270: MCSE Guide to Microsoft Windows XP Professional