5 MANAGING USER ACCOUNTS AND GROUPS

Transcription

1 MANAGING USER ACCOUNTS AND GROUPS.1 Introduction to user accounts Objectives.2 Types of User Accounts.2.1 Local User Account.2.2 Built-in User Account.2.3 Domain User Account.3 User Profile.3.1 Content of User Profile.4 Groups.4.2 Power users group.4.3 Users group.4.4 Guests group. Summary.6 Exercises At the end of this chapter students should be able to: Understand computer user account Explain different Windows XP user account Create and modify user account in Windows XP professional Define different rights Windows XP user account have Explain different Windows XP built-in accounts Explain user profile Copy or delete user profile Define user group and its importance Create a new group Add and remove users from a group

2 CLIENT OPERATING SYSTEM.1 INTRODUCTION TO USER ACCOUNTS Older versions of Microsoft Windows like Windows 9, Windows 98 and Windows ME do not need a user account like Windows XP Professional to access the computer. Concepts of user accounts in older system were merely a show rather than any useful functions like security or access level control. Apart from Windows XP, Microsoft has other secure operating system like Windows NT, Windows 2000, Windows 2003 and Windows Vista which need user name and password to access them. Figure -1 Unlike Windows 98, You Need a User Account to Access Windows XP Professional Unlike older versions of Windows, Windows XP Professional doesn't allow you to access system without logging into system through a valid user account. You will need a Windows XP user account to access any Windows XP Professional machine. That means you must have a user name and a password to access and operate Windows XP Professional on any machine. You can create separate accounts for each person that will be using the computer. This allows each user to have their own document folders and settings such as the wallpaper, Start menu, visual style, and so forth. A user account in Windows XP is a profile that defines user rights, customizations and settings. By utilizing user accounts on computers with more then one user, each user is able to specify and retain their personal Windows XP environments which he or she likes. A user account defines the following properties: Access rights. Desktop layout. Individual user favourites and history. Use of a private My Documents folder. 2

3 MANAGING USER ACCOUTS AND GROUPS User accounts allow a person to log on to a computer or a network. It also govern the access that person has to various resources. The ability a person has to perform certain actions on the computer is also determined by user account. In a classroom of Cosmopoint International University College (CIUC); students are provided with the latest computer systems with Windows XP Professional running on them. These computers are used by Cosmopoint Certified Software Specialist (CCSS) students in the morning to carry out the class projects using specific sets of software and access to certain folders. CCSS students have a particular user name and password to log into the system. Once they have successfully logged into Windows XP professional they are greeted with particular desktop wallpaper and shortcut icons. These shortcut icons on desktop are used to open different programs which they use in the class to carry out daily class routine. Figure -2 Windows XP Desktop Customized for CCSS Students 3

4 CLIENT OPERATING SYSTEM Later in the afternoon, the same computer systems are used by Aptech Certified Computer Professional (ACCP) students. These students have their own user name and password for the systems. However once they have logged onto the systems, they need different programs to do their class projects. Their desktop have different look. Apart from that, they have to save their work in different folders assigned by class lecturer. Once they logged into Windows XP Professional with the provided user login name and passwords, Windows XP Professional automatically loads a new profile which meet the need of ACCP students. Figure -3 Windows XP Desktop Customized for ACCP Students 4

5 MANAGING USER ACCOUTS AND GROUPS.2 TYPES OF USER ACCOUNTS A user account defines the actions a user can perform in Windows XP Professional. It allows user to log on to a computer system to gain access to computer resources. User accounts provide the facility to maintain individual Windows XP settings, preferences, secure documents and files. Windows XP Professional uses three types of user accounts. They are mentioned below: Local User Account Built-in User Account Domain User Account.2.1 Local User Account Local user account allows user to log on to a specific computer to access resources on that computer. Local user account s information resides on local computer and verified locally during login process. This account allows users to log on only to the computer on which the local user account has been created. Only resources available to local machine, on which user account exist can be accessed. Figure -4 Local User Account Information Resides on Local Security Database of Local Computer When you create a local user account, Windows XP Professional creates a local security database on that particular computer. Windows XP Professional uses this local security database to authenticate (verify) users during login process. If information regarding user is available in the security database then Windows XP will allow to log on to system. Local user accounts are kept locally on a single computer and it is never replicated on any other computer even it is connected to the network. Properties of Local User Account Provide access to resources on the local computer. Are created only on computers that are not in a domain. Are created in the local security database.

6 CLIENT OPERATING SYSTEM If you create a local user account in a workgroup of five computers running Windows XP Professional then you can log on to the computer on which you have created user account, not on other remaining four. You have to create a user account on all of five computers if you want to use them. The username and password on these systems do not need to be the same, but they must exist on the system on which you are going to log on. Microsoft recommends that you use local accounts only on computers that are part of workgroups. If the computer is connected to a domain then use domain user account, which is covered later in the same chapter LAB: Create a Local User Account 1. Login Windows XP Professional as an administrator (or account with administrator privilege). Click Start button, and then click Control Panel. 6

7 MANAGING USER ACCOUTS AND GROUPS If your control panel view is set to classic view, then please switch to category view. 2. Under Pick a category title, click User Accounts. 3. Under Pick a task title, click Create a new account. 7

8 CLIENT OPERATING SYSTEM 4. New User Accounts wizard will open. In the box provided type a name for the new account: and click Next You can use the person's full name, first name, or a nickname as computer user account. This user account name will be displayed when ever you restart the computer. You cannot assign the same user account name and computer name on the same PC.. Pick an account type box will appear. Select the radio button for the account type. A brief description of these two account type is also mentioned here. We will create a Limited account, select Limited and then click Create Account button. Once account has been created, other setting related to account can be changed, see LAB

9 MANAGING USER ACCOUTS AND GROUPS LAB: Another Way to Create a Local User Account 1. Click Start and then Run. 2. In Run command box type compmgmt.msc and click OK OR To access the Computer Management Window, right click mouse button on My Computer and select Manager 9

10 CLIENT OPERATING SYSTEM 3. The following Computer Management Windows will appear. Right click mouse button on Users folder and select New User. 4. New user form will appear, fill the form and click on create button 10

11 MANAGING USER ACCOUTS AND GROUPS Options available when creating a local user account User Name Text Fields Actions This is the user's logon name. Type the user name in this field by this name Windows XP will be login. This field is required. Full Name This is the user's full name. You can specify users full name here (First Name & Last Name). This field is optional. Description This field holds any descriptive text which you want to assign this user account, so that it will be easy for administrator to know about this account. Password This is the most important information about account if you want to make it safe and secure. Please read the password guideline, how to make a better and secure password. For security reason, always assign a password. For security reason, what ever you typed in this filed will not appears, but only asterisk will be shown. So remember what you type. Confirm Password Check Boxes User Must Change Password At Next Logon Type your password again to confirm the password you have typed before. Both password field confirm password and password should match for successful creation of user account. Actions If you want users to assign their own password when they login for the first time to Windows XP System then select this check box option. By doing so users only know about their password. This option is selected by default. User Cannot Change Password Check this option box, if you do not want user to change any password. In such cases administrator will have control of users password. If you have selected the User Must Change Password At Next Logon check box, this option is not available. Password Never Expires If you don t want to change your password and want to keep same password for a long period of time, select this check box. Domain user account password remains same for long time, so set such password with this option. The User Must Change Password At Next Logon option overrides this option, so if you have selected the User Must Change Password At Next Logon check box, this option is not available. Account Is Disabled If you want to block or stop any user using his/her account then please select this option. For example, employee who left or went for short leave will be his/her user account disabled. Table -1 Different Available Options for Creating and Modifying Local User Account 11

12 CLIENT OPERATING SYSTEM LAB: Switch Between Local User Accounts 1. Click Start, and then click Log Off When you switch between user accounts, you can leave programs running if you need them later. When you return back to your previous account, without restarting the computer, you will find all the programs open and running. 2. Once the Log Off Windows dialog box appears, click Switch User. 3. Windows XP will take you back to the login page, Click your account name. If you set up your account with a password then Windows XP will ask for it. Type the password and then click the green arrow button to login to Windows XP. 12

13 MANAGING USER ACCOUTS AND GROUPS LAB: Auto or Manual Logging? You can configure your computer so that it will automatically log itself on and go directly to load your favorite desktop setting when it boots up. This will automate the Windows XP logging process. If you have only one user account on your computer or you are only the user and you are completely unconcern about security then you can set you computer for auto logging. If you have personal laptop or desktop and you are only the user of Windows XP Professional which is installed on the system, then it is better to configure your Windows XP for automatic logging. It will avoid asking user login name and password, thus saving time during boot process. In reality, you can't actually eliminate the need for a user account and logon name. What you can do is tell Windows to automatically log on for you, by following this procedure: 1. Click Start button and then click Run. In Run text box field type control userpasswords2 and click OK 2. On the Users tab, uncheck Users Must Enter a User Name and Password to Use This Computer and click OK 13

14 CLIENT OPERATING SYSTEM.2.1. LAB: Modify a Local User Account 1. After Logging on to your computer as an administrator, click Start then click Control Panel. 2. Under Pick a category title, click User Accounts 3. User Accounts dialog box appears. Click change an account link under pick a task. 4. Select the account name which you want to modify. Select appropriate link to modify different account options. 14

15 MANAGING USER ACCOUTS AND GROUPS.2.2 Built-in User Account Windows XP professional has three types of built-in users account to make Windows administrator s job easy. Each account has a different set of account rights. Windows XP Professional 3 built-in account types are: Administrator User Account Limited User Account Guest User Account Administrator User Account Only administrator level users have full system access including access to other user accounts. Windows XP requires at least one administrator account which is created during the Windows XP installation. This account is responsible for maintaining all other user accounts and system resources. Figure - Rights of Administrator User Account Rights of an Administrator User Account: Can install software and hardware Can create, modify and delete user accounts Access all files and programs Create or change passwords for all user accounts Modify names, pictures and account types of all users Full access of system hardware and software 1

16 CLIENT OPERATING SYSTEM Limited User Account A limited user account is an account created for regular users of the computer. It is suggested that the administrator also create a user account and only use the administrative account for system maintenance. Figure -6 Rights of Limited User Account Rights of a Limited User Account: Allowed access to already installed software Can modify own user account with exception of account name or type Do not have rights to install software or hardware Allowed to create files in the Shared Document folder Can change your desktop theme, wallpaper and screensaver Guest User Account A guest user account is an account that used when someone needs to access the computer for a short period of time such as a temporary employee. No actual account is defined but the guest account needs to be activated by the administrator before it can be used. Rights of a Guest User Account: Do not have rights to install software or hardware Can not modify guest account or profile 16

17 MANAGING USER ACCOUTS AND GROUPS LAB: How to activate the Guest User Account 1. Right click My Computer icon and select Manage. Computer Management dialog box opens, under Local Users and Groups select Users. Figure -7 Computer Management Dialog Box 2. Right click on Guest icon and select Properties. Guest Properties dialog box appears, Uncheck Account is disabled checkbox and press OK 3. Now you can log on to this Windows XP machine using Guest account 17

18 CLIENT OPERATING SYSTEM Capability Administrative User Account Limited User Account Guest User Account Change your own picture Yes Yes Yes Create, change, or remove your Yes Yes No password Change your own account type Yes No No Change your own account name Yes No No Change other users' pictures, passwords, Yes No No account types, and account names Have full access to other user accounts Yes No No Create user accounts on this computer Yes No No Access and read all files on this computer Yes No No Install programs and hardware Yes No No Make system wide changes to the Yes No No computer Account is disabled by default No No Yes Allow to use computer and run applications Yes Yes Yes Table -2 Comparison among Administrator, Limited User and Guest User Account Mohd Azrul has very little knowledge about computer. Although he uses laptop with Windows XP professional running on it, he doesn t know how to utilize full features of Windows XP because his little knowledge is enough to do all his simple office tasks. Mohd Azrul has a daughter and she loves playing games as well as browsing the Internet. That is why her father, Mohd Azrul has bought a desktop PC with Windows XP professional installed on it for her. But most annoying and problematic experience Mohd. Azrul has faced everyday, is that his daughter without having much computer skills, click different links on different website (sometimes without understanding the implication of these links) and these un-trusted websites install spyware or adware without her full knowledge. Since she is not fully aware of different system files, she deletes some system files too, which creates problem to Windows XP operating system during boot up. Mohd Azrul consulted a computer technician on this matter. Technician advised him to set a limited user account for his daughter, so that she cannot install any programs or change any setting with that limited account and thus the problem will be solved. 18

19 MANAGING USER ACCOUTS AND GROUPS.2.3 Domain User Account Domain user accounts allow you to log on to the domain and access resources anywhere on the network. When you log on, you provide your logon information-your user name, password and domain name. Domain controller is server machine which uses this logon information to authenticate your identity and build an access token that contains your user information and security settings. The access token identifies you to the computers in the domain on which you try to access resources. The access token is valid throughout the logon session. Domain user account information resides on domain controller which allows you to login on any computer with same username and password as long as that computer is part of the domain. Unlike local user account, where account must reside on the local computer on which you login; domain user account can be accessed from any computer as long as the computer is a part of a domain, where account resides. What a Domain User Account can do: Provide access to network resources Provide access to server (Domain Controller) and its resources Allowed to access any resources on other computers which are part of that domain Active Directory is a Microsoft's directory database for Windows 2000 networks. Stores information about resources on the network and provides a means of centrally organizing, managing, and controlling access to the resources. You can have domain user accounts only if you have a domain controller, meaning at least one Windows Server (eg Windows NT Server, Windows 2000 Server or Windows 2003 Server) in your computer network. 19

20 CLIENT OPERATING SYSTEM Lab: Join a Computer to a Domain 1. Right-click on the My Computer icon, then click properties, then click Computer Name tap 2. Click the Change button, Computer Name Changes dialog box appears, select member of domain and type domain name in text box provided. [E.g. COSMOPOINT], Click OK 3. Domain Controller will check its database for this computer and successful result will be prompted. 20

21 MANAGING USER ACCOUTS AND GROUPS.2.4 Password Guidelines Password is very important and it should be safe guarded, especially Windows XP Professional administrative password. These are guidelines which you can follow to make your password hard to guess or steal. Determine whether the Administrator or the users will control passwords. You can assign unique passwords to user accounts or forced them to change regularly by implementing strong password policy. Use passwords that are hard to guess. For example, avoid using passwords with an obvious association, such as a family member s name. Using a real name, a user name, or a company name makes for an easy-to-guess password. Also avoid using common dictionary word like letmein or password. or Cosmopoint Using a common dictionary word makes you vulnerable to automated programs that are designed to guess passwords. Using any password that you write down or that you share with someone else is not secure. Passwords can contain up to 128 characters; a minimum length of 8 characters is recommended. Try avoid shorter password Include both uppercase and lowercase letters (unlike user names, user passwords are case sensitive), numerals, and the valid non-alphanumeric characters (such as punctuation). Using no password at all is not a good practice because it is then easy for other users to just walk up to an unsecured computer and log on. Combining symbols like $ % ^ & * ( ) _ + [ ] < >? :, or spaces, which are allowed to be used as a password) make password more secure. Don t forget to change or advise user to change password regularly.. Creating Strong Passwords You should encourage users to select and use strong passwords because weak passwords are big security threat to your system. You can follow the above mentioned guidelines to create strong passwords. Try to avoid using shorter passwords. Since passwords are case sensitive; passwords which are combination of lower letters, upper letters and numbers are even better than just having lower or upper letter only. 21

22 CLIENT OPERATING SYSTEM.3 USER PROFILE Whenever you create a user account, whether it is on a local machine or a remote server, Windows machine will create a profile called user profile. User profile contains all the information that the computer needs to personalize your system s look and feel. Your user profile contains your desktop icons, shortcuts, personalized Start menu and your personalized files folders like My Documents and My Pictures. Some critical information about profile like your network settings, network printer definitions and desktop setting are stored in Windows Registry by the name of NTUSER.DAT file. When you login to Windows, this file is read and Windows will set your environment accordingly..3.1 Content of User Profile The user profile contains some important stuff and it's used in a special way. The contents of its Desktop subfolder, for instance, appear on your desktop when you log on, and the contents of its Start Menu subfolder appear when you click the Start button. The table below summarized the content of user profile. Items Application data Cookies Desktop Favorites Local Settings Documents NTUSER.DAT NetHood Recent SendTo Start Menu Templates Contains User-specific files needed by application programs such as Explorer and Outlook Express. Internet Explorer (IE) data. Icons and files displayed on the desktop. This is where desktop stuff is actually stored. Lists of shortcuts used by the Favorites menu in IE. Like Application Data; includes temporary files. User's My Documents folder. User's Registry data (HKEY_CURRENT_USER). Shortcut icons used by My Network Places. Shortcuts to recently accessed documents. Shortcuts used to fill the "Send To" context menu. Shortcuts displayed on the user's Start menu. Templates used by various applications to create blank documents. Table -3 Content of User Profile 22

23 MANAGING USER ACCOUTS AND GROUPS LAB: Copy or Delete User Profile The Windows XP Profile Manager will let you copy profile data from one account to another or one computer to another. To run the Profile Manager, you must log on as a Computer Administrator and follow these steps: 1. Select Start and right-click My Computer. Select Properties and view the Advanced tab. 2. In the User Profiles area click Settings button, User Profiles will open, here you can copy, delete and Modify user profiles by clicking suitable buttons 23

24 CLIENT OPERATING SYSTEM.4 GROUPS Every local user account of Windows XP Professional belongs to one or more local user groups. A set of users can be put into a group who shares similar rights and control over Windows XP machine. Group has certain properties which are listed below: Properties of a Group Groups are collections of user accounts Members of same group have similar permissions and rights A single user can be a member of multiple groups Groups, itself can become a members of other groups Groups help in controlling and managing computer resources over a network Groups make the administration of user accounts easier by allowing you to group together users who share common security and access need. Windows XP Professional has four primary user groups. They area: Administrators Power Users Users Guests 24

25 MANAGING USER ACCOUTS AND GROUPS.4.1 Administrators group Members of the Administrators group have the largest amount of default permissions and rights. They have ability to change their own permissions and others. Administrators group is most powerful group of all, so decide carefully before adding users to this group. User having membership of administrators group has following rights: Install the operating system and components (such as hardware drivers, system services, and so on). Install Service Packs and Windows Packs. Upgrade the operating system. Repair the operating system. Configure critical operating system parameters (such as password policy, access control, driver configuration, and so on). Take ownership of files that have become inaccessible. Manage the security and auditing logs. Back up and restore the system..4.2 Power users group Members of the Power Users group have more permissions than members of the Users group but fewer than members of the Administrators group. Power Users can perform any operating system task except tasks reserved for the Administrators group. They cannot modify any properties of Administrators group. Rights of Power Users group are mentioned below: Run legacy applications, in addition to Windows XP Professional certified applications. Install programs that do not modify operating system files or install system services. Customize system wide resources including printers, date, time, power options, and other Control Panel resources. Create and manage local user accounts and groups. Stop and start system services which are not started by default. 2

26 CLIENT OPERATING SYSTEM.4.3 Users group Members of the Users group can perform most common tasks. These tasks include running applications, using local and network printers, and shutting down and locking the workstation. Member of Users group can create local groups, but can modify only the local groups that they have created. Users cannot share directories or create local printers. The Users group is the most secure, because the default permissions allotted to this group do not allow members to modify operating system settings or other users' data. Rights of Users group are mentioned below: Users cannot modify system wide registry settings, operating system files, or program files. Users can shut down workstations, but not servers. Users can create local groups, but can manage only the local groups that they created. They can run certified Windows XP Professional programs that have been installed or deployed by administrators. Users have Full Control over all of their own data files located in (%userprofile%).4.4 Guests group The guest account is the member of guest group. Guest groups are intended for those users who have no user account on the computer. There is no password for the member of guest group, so the user can log on quickly to check or browse the Internet. A user logged on to the guest account: Cannot install software or hardware, but can access programs that have already been installed on the computer. Cannot change the properties of guest account type of guest group Can change the own guest account picture 26

27 MANAGING USER ACCOUTS AND GROUPS.4. LAB: Create a group and add/remove user to the group 1. Right click on My Computer icon and select Manage 2. When Computer Management dialogue box opens, expand local Users and Groups list, select Groups. Right click groups then select New Group from popup menu 27

28 CLIENT OPERATING SYSTEM 3. Fill in the Group Name and Description of new group. You can also add users to this group by clicking add button, once done click create. 4. You can add or remove users by selecting their names once you have created new group and assigned users to it, by going to that group properties. 28

29 MANAGING USER ACCOUTS AND GROUPS. SUMMARY 1. Windows XP Professional need a valid user account and password to access it while Windows 98 and Windows 9 don t need. 2. With a user account on Windows XP, you can define access rights and desktop layout and other similar issues. 3. Three types of accounts are: Local User Account, Built-in User Account and Domain User Account. 4. Local user account database resides on local computer where as domain user account information resides on domain controller machine.. Local user account name and computer name cannot be same for a computer. 6. Three types of Windows XP built-in accounts are: Administrator User Account, Local User Account and Guest User Account. 7. Administrator User Account of Windows XP has full control of computer resources and all other accounts. 8. Limited User Account has limited rights. This account allows user to customise his/her pictures, desktop theme, etc but does not allow installation of software or to modify other account. 9. Guest User Account is made for temporary use and it is disabled by default. 10. Domain user account information resides on domain controller which allows you to login on any computer with same username and password as long as that computer is part of the domain. 11. Whenever you create a user account, whether it is on a local machine or a remote server, Windows machine will create a profile called user profile. 12. Every local user account of Windows XP Professional belongs to one or more local user groups. 29

30 CLIENT OPERATING SYSTEM.6 EXERCISES True or False 1. Windows 98 and Windows 9 are secure as Windows XP. True False 2. You need a valid user name and password to login Windows 98. True False 3. You cannot login to Windows XP without valid user name and password. True False 4. Administrator is a built-in account of Windows XP. Domain user account resides on the local machine True True False False 6. Advantage of domain user account is that you can login from any computer which is part of domain. True False 7. Local user account provides access to domain resources True False 8. Computer name and local user name can be same on Windows XP machine. True False 9. You can delete your user account password without deleting user login name. True False 10. You can change your user login name once you have created it. True False 30

31 MANAGING USER ACCOUTS AND GROUPS Fill in the Blanks 1. One of the Windows XP built-in account is. 2. Windows XP need and to gain access. 3. You can create new user account by going into panel. 4. Local user account resides on computer.. You can access Computer Management dialog box by right clicking icon. 6. While creating local user account, user name is field. 7. One of the optional fields while creating local user account is. 8. account is disabled by default. 9. Two built-in local user accounts are and. 10. It is better to have password at list characters long. 31

32 CLIENT OPERATING SYSTEM Multiple Choice Questions 1. Which of the following statements about domain user accounts are correct? (Choose all that apply.) A. Domain user accounts allow users to log on to the domain and gain access to resources anywhere on the network, as long as the users have the required access permissions. B. If at least one computer on the network is configured as a domain controller, you should use domain user accounts only. C. The domain controller replicates the new user account information to all other computers in the domain. D. A new domain user account is established in the local security database on the domain controller on which you created the account. 2. Which of the following statements about built-in accounts are correct? (Choose all that apply.) A. You can delete the Guest account. B. You cannot delete the Administrator account. C. You cannot rename the Guest account. D. You can rename the Administrator account. 3. User account defines which of the following properties? (select all that apply) A. Access rights B. Desktop layout C. Individual favourites and history D. Software right E. Hardware right 32

33 MANAGING USER ACCOUTS AND GROUPS 4. Select different user account types on Windows XP Professional. (Select all that apply) A. Local User Account B. Global User Account C. Domain User Account D. Virtual User Account E. Built-in User account Subjective Questions 1. List the steps involved in creating new local user account on Windows XP Professional? 2. What is a user profile? 3. Compare Windows 98 and Windows XP login process and security. 4. List different types of user accounts.. What is user profile? 6. What is a computer user group? List user group properties. 33