11 WORKING WITH USER ACCOUNTS Chapter 6

Chapter 6: WORKING WITH USER ACCOUNTS2 UNDERSTANDING USER ACCOUNTS  Local user accounts  stored in the Security Accounts Manager (SAM) database on that system  Can be used only on that system  Domain user accounts  Stored in Active Directory on domain controllers  Can be used on any system in Active Directory  Local user accounts  stored in the Security Accounts Manager (SAM) database on that system  Can be used only on that system  Domain user accounts  Stored in Active Directory on domain controllers  Can be used on any system in Active Directory

Chapter 6: WORKING WITH USER ACCOUNTS3 WORKGROUPS  No centralized database of user accounts  User account must exist in the SAM of each system the user accesses  Impractical in environments with more than 10 users  No centralized database of user accounts  User account must exist in the SAM of each system the user accesses  Impractical in environments with more than 10 users

Chapter 6: WORKING WITH USER ACCOUNTS4 DOMAINS  Centralized database of user accounts  User accounts exist in the Active Directory Hierarchy on the Domain controller  Centralized database of user accounts  User accounts exist in the Active Directory Hierarchy on the Domain controller

Chapter 6: WORKING WITH USER ACCOUNTS5 PLANNING USER ACCOUNTS  Account naming  Choosing passwords  Designing an Active Directory hierarchy  Account naming  Choosing passwords  Designing an Active Directory hierarchy

Chapter 6: WORKING WITH USER ACCOUNTS6 ACCOUNT NAMING  Account names can be between 1 and 20 characters (letters and/or numbers).  Account names are not case sensitive.  The following characters cannot be used in the account name:  " / \ [ ] : ; |, + = *  Choose an account naming scheme that is logical and stick to it  Account names can be between 1 and 20 characters (letters and/or numbers).  Account names are not case sensitive.  The following characters cannot be used in the account name:  " / \ [ ] : ; |, + = *  Choose an account naming scheme that is logical and stick to it

Chapter 6: WORKING WITH USER ACCOUNTS7 CHOOSING PASSWORDS  Choose a password policy that matches the security needs of your organization

Chapter 6: WORKING WITH USER ACCOUNTS8 DESIGNING AN ACTIVE DIRECTORY HIERARCHY  Create an organizational unit (OU) structure  Place users in appropriate OU  Provides for features such as group policy  Create an organizational unit (OU) structure  Place users in appropriate OU  Provides for features such as group policy

Chapter 6: WORKING WITH USER ACCOUNTS9 WORKING WITH LOCAL USER ACCOUNTS

Chapter 6: WORKING WITH USER ACCOUNTS10 CREATING A LOCAL USER ACCOUNT

Chapter 6: WORKING WITH USER ACCOUNTS11 MANAGING LOCAL USER ACCOUNTS

Chapter 6: WORKING WITH USER ACCOUNTS12 WORKING WITH DOMAIN USER ACCOUNTS

Chapter 6: WORKING WITH USER ACCOUNTS13 CREATING A DOMAIN USER ACCOUNT

Chapter 6: WORKING WITH USER ACCOUNTS14 MANAGING DOMAIN USER ACCOUNTS  From the Action menu, you can:  Reset a user account password.  Rename, disable, and delete an account.  Modify group membership.  Send and open a user’s homepage.  From the Action menu, you can:  Reset a user account password.  Rename, disable, and delete an account.  Modify group membership.  Send and open a user’s homepage.

Chapter 6: WORKING WITH USER ACCOUNTS15 THE GENERAL TAB

Chapter 6: WORKING WITH USER ACCOUNTS16 THE ADDRESS TAB

Chapter 6: WORKING WITH USER ACCOUNTS17 THE TELEPHONES TAB

Chapter 6: WORKING WITH USER ACCOUNTS18 THE ORGANIZATION TAB

Chapter 6: WORKING WITH USER ACCOUNTS19 THE ACCOUNT TAB

Chapter 6: WORKING WITH USER ACCOUNTS20 THE PROFILE TAB

Chapter 6: WORKING WITH USER ACCOUNTS21 THE MEMBER OF TAB

Chapter 6: WORKING WITH USER ACCOUNTS22 THE TERMINAL SERVICES PROFILE TAB

Chapter 6: WORKING WITH USER ACCOUNTS23 THE ENVIRONMENT TAB

Chapter 6: WORKING WITH USER ACCOUNTS24 THE REMOTE CONTROL TAB

Chapter 6: WORKING WITH USER ACCOUNTS25 THE SESSIONS TAB

Chapter 6: WORKING WITH USER ACCOUNTS26 THE DIAL-IN TAB

Chapter 6: WORKING WITH USER ACCOUNTS27 THE COM+ TAB

Chapter 6: WORKING WITH USER ACCOUNTS28 MANAGING MULTIPLE USERS

Chapter 6: WORKING WITH USER ACCOUNTS29 MOVING USER OBJECTS

Chapter 6: WORKING WITH USER ACCOUNTS30 CREATING MULTIPLE USER OBJECTS  Using object templates  Using Csvde.exe  Using Dsadd.exe  Using object templates  Using Csvde.exe  Using Dsadd.exe

Chapter 6: WORKING WITH USER ACCOUNTS31 USING OBJECT TEMPLATES  Can be an existing user account or an account created specifically for copying.  Not all properties are copied.  Object templates should be disabled to prevent use of the account.  New users are created by copying the user template object  Can be an existing user account or an account created specifically for copying.  Not all properties are copied.  Object templates should be disabled to prevent use of the account.  New users are created by copying the user template object

Chapter 6: WORKING WITH USER ACCOUNTS32 IMPORTING USER OBJECTS USING CSV DIRECTORY EXCHANGE  Useful for creating large numbers of users at a time.  Step 1: Create a comma-separated value (CSV) text file of user information.  Step 2: Use Csvde.exe to import the user information from the CSV file into Active Directory.  Useful for creating large numbers of users at a time.  Step 1: Create a comma-separated value (CSV) text file of user information.  Step 2: Use Csvde.exe to import the user information from the CSV file into Active Directory.

Chapter 6: WORKING WITH USER ACCOUNTS33 CREATING USER OBJECTS WITH DSADD.EXE  Command-line utility  Can be used in batch files or scripts  Can be used to add other objects as well as users  Command-line utility  Can be used in batch files or scripts  Can be used to add other objects as well as users

Chapter 6: WORKING WITH USER ACCOUNTS34 MODIFYING USER OBJECTS WITH DSMOD.EXE  Command-line utility  Can be used in batch files or scripts  Can be used only to modify existing objects  Command-line utility  Can be used in batch files or scripts  Can be used only to modify existing objects

Chapter 6: WORKING WITH USER ACCOUNTS35 MANAGING USER PROFILES  Allows each user to have a customized working environment  Preserves application settings, shortcuts, and preferences  Ensures that users do not affect each other’s work environment  Allows each user to have a customized working environment  Preserves application settings, shortcuts, and preferences  Ensures that users do not affect each other’s work environment

Chapter 6: WORKING WITH USER ACCOUNTS36 USER PROFILE CONTENTS  User-stored documents and files  Application configurations and settings  Desktop and environment settings  Control Panel settings and configurations  User-stored documents and files  Application configurations and settings  Desktop and environment settings  Control Panel settings and configurations

Chapter 6: WORKING WITH USER ACCOUNTS37 USER PROFILE DIRECTORY STRUCTURE

Chapter 6: WORKING WITH USER ACCOUNTS38 USING LOCAL PROFILES  Stored on the local system  Available only when the user logs on to that system  Can be modified by the user as needed  Stored on the local system  Available only when the user logs on to that system  Can be modified by the user as needed

Chapter 6: WORKING WITH USER ACCOUNTS39 USING ROAMING PROFILES  Allows a user to have the same working environment from any client computer she logs on to.  Central storage provides for easier backup.  Allows a user to have the same working environment from any client computer she logs on to.  Central storage provides for easier backup.

Chapter 6: WORKING WITH USER ACCOUNTS40 USING MANDATORY PROFILES  Can be either local or roaming.  User can make changes, but changes are not saved when user logs off.  Renaming Ntuser.dat to Ntuser.man designates profile as mandatory.  Can be either local or roaming.  User can make changes, but changes are not saved when user logs off.  Renaming Ntuser.dat to Ntuser.man designates profile as mandatory.

Chapter 6: WORKING WITH USER ACCOUNTS41 MONITORING AND TROUBLESHOOTING USER AUTHENTICATION  Using password policies  Using account lockout policies  Using password policies  Using account lockout policies

Chapter 6: WORKING WITH USER ACCOUNTS42 USING PASSWORD POLICIES  Provides a mechanism to control password use in the organization.  Should strike a balance between usability and security.  Creating a password policy that is too demanding increases password-related support calls.  Provides a mechanism to control password use in the organization.  Should strike a balance between usability and security.  Creating a password policy that is too demanding increases password-related support calls.

Chapter 6: WORKING WITH USER ACCOUNTS43 USING ACCOUNT LOCKOUT POLICIES  Account Lockout Threshold  Account Lockout Duration  Reset Account Lockout Counter After  Account Lockout Threshold  Account Lockout Duration  Reset Account Lockout Counter After

Chapter 6: WORKING WITH USER ACCOUNTS44 ACTIVE DIRECTORY CLIENTS  Windows 2000, Windows XP, and Windows Server 2003 include full Active Directory client capabilities.  Windows 95, Windows 98, Windows Me, and Windows NT 4 require additional client software to gain full Active Directory functionality.  Windows 2000, Windows XP, and Windows Server 2003 include full Active Directory client capabilities.  Windows 95, Windows 98, Windows Me, and Windows NT 4 require additional client software to gain full Active Directory functionality.

Chapter 6: WORKING WITH USER ACCOUNTS45 AUDITING AUTHENTICATION  Allows you to track failed and successful logon attempts  Can form part of a security policy  Creates minimal system overhead in all but largest environments  Events are created in the Security log  The security log can be viewed with Event Viewer  Allows you to track failed and successful logon attempts  Can form part of a security policy  Creates minimal system overhead in all but largest environments  Events are created in the Security log  The security log can be viewed with Event Viewer