11 MANAGING USERS AND GROUPS Chapter 13

Chapter 13: MANAGING USERS AND GROUPS2 OVERVIEW  Configure and manage user accounts  Manage user account properties  Manage user and group rights  Configure user account policy  Manage and troubleshoot cached credentials  Configure and manage user accounts  Manage user account properties  Manage user and group rights  Configure user account policy  Manage and troubleshoot cached credentials

Chapter 13: MANAGING USERS AND GROUPS3 USER ACCOUNTS  Identify users to the system and to each other  Used to grant access to resources  Collect information about users  Identify users to the system and to each other  Used to grant access to resources  Collect information about users

Chapter 13: MANAGING USERS AND GROUPS4 GROUPS  Collections of user accounts  Simplify access to resources  Can be used for security and messaging (Active Directory)  Collections of user accounts  Simplify access to resources  Can be used for security and messaging (Active Directory)

Chapter 13: MANAGING USERS AND GROUPS5 BUILT-IN USER ACCOUNTS  Configured during setup  Used for administration or guest access  Can be renamed but not deleted  Configured during setup  Used for administration or guest access  Can be renamed but not deleted

Chapter 13: MANAGING USERS AND GROUPS6 BUILT-IN GROUPS  Created during setup  Designed for specific use or administrative roles  User accounts can be added as members  Built-in user accounts cannot be removed  Created during setup  Designed for specific use or administrative roles  User accounts can be added as members  Built-in user accounts cannot be removed

Chapter 13: MANAGING USERS AND GROUPS7 IMPLICIT GROUPS  Membership can change dynamically  Do not appear in user administration tools  Used to grant permissions based on circumstances  Membership can change dynamically  Do not appear in user administration tools  Used to grant permissions based on circumstances

Chapter 13: MANAGING USERS AND GROUPS8 SERVICE ACCOUNTS  Grant services access to system resources  Include built-in and user-defined accounts  Require special accommodations  Grant services access to system resources  Include built-in and user-defined accounts  Require special accommodations

Chapter 13: MANAGING USERS AND GROUPS9 DOMAIN ACCOUNTS AND GROUPS  Include built-in and user-defined accounts and groups  Provide logon and resource access to local system  Can be placed into local groups  Include built-in and user-defined accounts and groups  Provide logon and resource access to local system  Can be placed into local groups

Chapter 13: MANAGING USERS AND GROUPS10 LOCAL USERS AND GROUPS

Chapter 13: MANAGING USERS AND GROUPS11 CONTROL PANEL USER ACCOUNTS

Chapter 13: MANAGING USERS AND GROUPS12 ACTIVE DIRECTORY USERS AND COMPUTERS

Chapter 13: MANAGING USERS AND GROUPS13 MANAGING USERS WITH NET.EXE

Chapter 13: MANAGING USERS AND GROUPS14 PLANNING USERS AND GROUPS

Chapter 13: MANAGING USERS AND GROUPS15 USER ACCOUNT NAMING CONVENTIONS

Chapter 13: MANAGING USERS AND GROUPS16 PASSWORD COMPLEXITY  Create passphrases  Use uppercase, lowercase, and nonalphanumeric characters  Consider enforcing complexity with Group Policy  Create passphrases  Use uppercase, lowercase, and nonalphanumeric characters  Consider enforcing complexity with Group Policy

Chapter 13: MANAGING USERS AND GROUPS17 CHANGING HOW USERS LOG ON OR LOG OFF

Chapter 13: MANAGING USERS AND GROUPS18 MANAGING USERS WITH LOCAL USERS AND GROUPS

Chapter 13: MANAGING USERS AND GROUPS19 MANAGING GROUPS WITH LOCAL USERS AND GROUPS

Chapter 13: MANAGING USERS AND GROUPS20 MANAGING GROUPS WITH NET.EXE

Chapter 13: MANAGING USERS AND GROUPS21 MANAGING USERS WITH USER ACCOUNTS

Chapter 13: MANAGING USERS AND GROUPS22 USER MANAGEMENT BEST PRACTICES  Give administrators a limited account for nonadministrative use  Limit the number of users in the Administrators group  Rename or disable the Administrator account  Rename and leave the Guest account disabled  Observe the principle of least privilege  Give administrators a limited account for nonadministrative use  Limit the number of users in the Administrators group  Rename or disable the Administrator account  Rename and leave the Guest account disabled  Observe the principle of least privilege

Chapter 13: MANAGING USERS AND GROUPS23 MANAGING USER RIGHTS ASSIGNMENTS

Chapter 13: MANAGING USERS AND GROUPS24 MANAGING PASSWORD POLICY

Chapter 13: MANAGING USERS AND GROUPS25 MANAGING ACCOUNT LOCKOUT POLICY

Chapter 13: MANAGING USERS AND GROUPS26 CACHED CREDENTIALS  Cache users’ logon information for offline authentication  User must log on to the domain at least once  Can be disabled to force logons to use domain  Cache users’ logon information for offline authentication  User must log on to the domain at least once  Can be disabled to force logons to use domain

Chapter 13: MANAGING USERS AND GROUPS27 MANAGING CACHED CREDENTIALS

Chapter 13: MANAGING USERS AND GROUPS28 TROUBLESHOOTING CACHED CREDENTIALS  Cached credentials are out of date  User does not have credentials cached  Cached credentials are disabled on a notebook computer  Cached credentials are out of date  User does not have credentials cached  Cached credentials are disabled on a notebook computer

Chapter 13: MANAGING USERS AND GROUPS29 SUMMARY  User accounts help manage resource access.  User groups simplify administration.  Naming conventions uniquely identify users.  Complex passwords strengthen security.  Cached credentials allow access when the domain is unavailable.  User accounts help manage resource access.  User groups simplify administration.  Naming conventions uniquely identify users.  Complex passwords strengthen security.  Cached credentials allow access when the domain is unavailable.