Updating The Operating System & User Accounts

Transcription

1 U Updating he perating ystem & User Accounts P

2 PAG YM UPA Update A minor revision to a software product, usually intended to address specific performance issues rather than add new features Upgrade A major revision to a product that might include new features as well as all of the existing patches for the previous version of the product P

3 C PACK A collection of patches and other updates that are tested and packaged as a single unit ervice packs are cumulative: P contains all updates from P and P ervice pack releases are not on a schedule P

4 C PACK LA C-M ntire service pack on C xpress download Analyzes system and downloads only required components etwork download ntire service pack in a single file P

5 UALLG C PACK equires considerable disk space ervice packs can be uninstalled through Add/emove Programs in Control Panel hould be done only if the service pack installation is causing new issues P

6 HFX esigned to address a specific issue ownloadable as a single executable ormally directly associated with a Knowledge Base article P

7 hen hould You Update? P

8 BAL CUY AALYZ P

9 UG UPA P

10 AUMAC UPA Available in indows erver, indows XP (ervice Pack ), indows (ervice Pack ). efault is to automatically download updates and prompt the user to install them. Configured via the Automatic Updates tab in ystem Properties. n indows, it is configured via the Automatic Updates control panel. P

11 nstalling Updates Manual installation LPAMG lipstreaming a service pack lipstreaming hotfixes Chaining Use Qchain.exe to install multiple hotfixes Use /Z switch to prevent restarts. Group Policies software installation capability P

12 GUP PLCY UPA P

13 FA UPA C U Allows software updates to be downloaded once for the entire organization Provides administrative control over what updates are applied to clients educes nternet usage P

14 ALLG U P

15 YCHZG U P

16 APPG UPA P

17 BULG U PLGY Multiple-server topology trict parent/child topology Loose parent/child topology P

18 U MG n the server, information can be viewed through: Monitor erver page ynchronization Log, Approval Log, wutrack.bin file n the client, information can be viewed through: indows Update Log U-generated events are written to ystem log of the vent iewer: ach time a synchronization is performed hen updates are approved P

19 UBLHG U eloading the memory cache estarting the synchronization service estarting P

20 FA LC he nd-user License Agreement (ULA) is a binding contract that gives you the legal right to use a piece of software. n an enterprise environment, managing software licenses is critically important. P

21 P LCG ach server permits a certain number of concurrent connections. nce the limit is reached, connections are refused. Usually only practical in environments with a single server. P

22 P C P U A Client Access License (CAL) is required for each user or device that will connect to the server. CALs are normally obtained in bundles (5,, 5, 5, ). CALs are not a physical object, but an entitlement to connect to a indows network. P

23 LC GUP A license group is a collection of users who share one or more CALs. License groups are created when: A single user uses more than one device, such as a computer. More than one user uses a single device, such as a computer. P

24 LCG L Licensing in Control Panel Manages licensing for a single computer running indows erver Licensing in Administrative ools Centralized control of licensing and license replication in a site-based model P

25 LCG License Logging service assigns and tracks licenses. Licensing information is replicated to a centralized licensing database. Use the Licensing tool in the Administrative ools program group to view and manage licensing for an entire site. P

26 User Accounts P

27 efinitions User - individual granted access to the system Groups - logical collection of users Accounts - Logical construct containing all information that defines a user to the environment esources - All equipment attached to the workstation or network P

28 efinitions Home irectories - dedicated locations on a file server for a specific user to store files Policy - a set of configurations that allows an administrator to restrict a user s access and rights Profile - file containing a user s environmental settings and preferences P

29 Create Copy elete isable ename Account perations P

30 User/Group ame ules he name must be unique to the machine for local accounts (or unique to the domain in the case of domain accounts). he username cannot be the same as a group name he name may be up to characters, upper or lowercase or a combination of both. P

31 User/Group ame ules o avoid confusion with special syntax characters, names may not include any of the following: " / \ [ ] : ; =, + *? < > he name may include spaces and periods, but may not consist entirely of spaces or periods. : ames including spaces have to be enclosed in quotes for both scripting or command-line use. Better to avoid using spaces. P

32 Users ach user must have an account to access a computer running the windows operating system User properties Groups associated with the user Profile path Login script Home directory P

33 Passwords Case sensitive ptional Accounts Complexity rules enforced by default Accounts live in the %systemroot%:\winnt\system\config directory in the AM file or stored in the active directory database P

34 User Account ptions User Must Change Password at ext Logon - Forces a user to change their password the next time they log on and afterward the box will be unchecked. User Cannot Change Password - f checked, prevents the user from changing the account s password. P

35 User Account ptions Password ever xpires - f checked, the user account ignores the password expiration policy, and the password for the account never expires Account s isabled - f checked, the account is disabled and no one can log on to it until it is enabled (it is not, however, removed from the database). P

36 AUHCA Active irectory Authentication Process esources Access oken User identification Group memberships Privileges assigned to user (also named system rights) P

37 U ACCU Local User Accounts tored in the ecurity Accounts Manager (AM) Built-in user accounts (administrator and guest) omain user accounts (.dit) omain local Built-in user accounts are automatically created during the install P

38 AMA Full control of computer, domain or forest depending on the context Used to establish administrative structure and create other accounts hould be renamed hould be secured with a complex password Can be disabled, but cannot be deleted hould not be used for every day user tasks P

39 GU ACCU esigned to allow temporary access to the network isabled by default, but cannot be deleted hould be secured with a complex password if enabled P

40 User Account emonstration P

41 User Profiles P

42 User Profile A profile is a napshot of a user s desktop environmental settings stored in the ntuser.dat file Can exist on single a computer or on the network on a domain controller he profiles are stored in c:\ocuments and ettings directory P

43 Profile ypes Local - stored on the local machine and applies to the local machine oaming - stored on the server and applies to any machine that the user is allowed to logon locally Mandatory - a read only copy of the user s profile with a.man extension. he user can change some settings in indows but cannot save the changes. P

44 Account Policies Use the Local ecurity Policy tool (CPL.MC) to set such as lockout restrictions or auditing, or the Group Policy snap-in (GP.MC). he process is very similar to configuring Group Policy with the Active irectory tools except that, since the machine is not a domain controller, changes will apply to the local policy for the machine. P

45 Account Policies he policies created will be local policies, which will live in the local machine s egistry database. P

46 Account Policy ettings Maximum Password Age - time period until password change is required -999 days or never default = 4 days Minimum Password Age - time period when password change is prevented -999 days or immediately efault = immediately P

47 Account Policy ettings Minimum Password Length -4, or blank efault = Permit blank nforce password History - prevents password reuse -4 history list or none efault = o history P

48 Account Policy ettings Passwords must meet complexity rules efault = disabled tore passwords using reversible encryption efault = disabled Account lockout efault = not defined efault time = minutes P

49 Account Policy ettings Account lockout threshold (Account lockout must be enabled) efault = invalid attempts ange is to 999 eset lockout counter after (Account lockout must be enabled) efault = not defined ange to 99,999 minutes P

50 Audit Policy ettings Account Logon events - tracks account logon, logoff Logon events - network connection bject access - tracks files directories and print access Audit Privilege Use - tracks when user exercises a user right Account management - tracks creation, deletion and management of users and groups P

51 User ights P

52 User ights User rights define what a user can and cannot do on the system P

53 efault User ights Log on locally on a workstation Administrators Account operators Power users Print operators eplicators Backup perators erver operators Guests Users P

54 efault User ights Backup and estore Files and directories Administrators Backup operators erver perators Access this computer from the etwork Administrators veryone Create and manage user and groups Administrators Account perators P

55 efault User ights Change system time Administrators Power users erver perators Force remote shutdown Administrators Power users erver operators Lock and Unlock the server console Administrators erver perators P

56 efault User ights nly Administrators can perform these tasks Format the server s hard disk Load and unload device drivers Assign user rights Manage auditing and security log Manage auditing and security policy Create common program groups Keep a local profile hare and stop sharing directories ncrease the priority of a process P

57 efault User ights ake ownership of objects Administrators hut down the system Administrators Account operators Power users Backup perators erver operators Users P