Mastering Windows XP Professional, Third Edition

Chapter 20: Living with Windows XP Professional Strict Security\ In the previous chapter, I walked you through the steps for creating and configuring a network, but one big piece of the networking pie is still missing: securing the resources on your network. From its inception, the NT family of operating systems was designed with security as a primary feature, and, of course, this architectural element is omnipresent in the Windows XP Professional.\ Unlike some other operating systems, Windows XP Professional requires you to create a user account for yourself right on your PC before you can do anything on that PC. Yes, the idea that you must create your own user account on your personal PC before you can do anything with the PC is unusual-after all, most of us are accustomed to requiring network accounts, but not particular accounts on a workstation. But-as your father might say when you complain that something you don't like isn't fair-get used to it!\ The user account is an integral part of Windows XP Professional and has some great benefits. For example, suppose you and Sue share a computer. You can set up the computer so that you own a folder on the hard disk and Sue owns another folder on the hard disk, and it is completely impossible for Sue to access your data (and vice versa) unless you give her permission.\ In addition, you can restrict access to files and folders by setting permissions. As you may recall, in Windows XP Professional you can use the FAT, FAT32, or NTFS file system. If you use either FAT system, you can exercise only a limited amount of control over file and folder access, but if you use the NTFS system, you can exercise a great deal of control-whether the files are on your local computer or on your network.\ In this chapter, we'll first look at how to set up user accounts, and then we'll look in detail at establishing permissions for shares, files, and folders.\ In this chapter:\ \ Understanding and creating accounts in Windows XP Professional\ Setting permissions\ Understanding ownership\ \ Understanding User Accounts in Windows XP Professional\ As you have just read, you must create separate user accounts on a Windows XP Professional machine before any user can log on to the workstation-and, unlike Windows 9x, Windows XP Professional won't let you get anywhere until you log on. \ If your computer is part of a Windows XP Professional client-server network, two types of user accounts are available: domain accounts and local accounts. A domain account gives you access to the network and to the network resources for which you have permission. The manager of the server normally sets up domain accounts, which are stored in a directory on the server. The directory can either be Active Directory or a Windows NT domain directory.\ A local user account is valid only on your local computer; local user accounts sit in a database called the Security Accounts Manager, or SAM. You create user accounts with the Users and Passwords applet, which you'll meet later in this chapter.\ In this chapter, I'm going to talk about local user accounts only. If you happen to be the administrator of a domain on a network and you need help creating domain user accounts, take a look at Mastering Windows 2000 Server, Third Edition (Sybex, 2001).\ Before I get into how you change or create an account, we need to look at the types of accounts in Windows XP Professional. The two broad categories are users and groups. A user account identifies a user on the basis of their user name and password. A group account contains other accounts, and these accounts share common privileges.\ User accounts are of three types:\ Computer Administrator This account has full and complete rights to the computer and can do just about anything to the computer. The Computer Administrator account was created during installation and setup of Windows XP Professional. The Computer Administrator account cannot be deleted. You'll need to log on as Computer Administrator when you want to create new accounts, take ownership of files or other objects, install software that will be available to all users, and so on.\ Limited This account is intended for use by regular old users, those who should not be allowed to install software or hardware or change their user name. Someone with a limited account can change their password and logon picture.\ Guest This built-in account allows a user to log on to the computer even though the user does not have an account. No password is associated with the Guest account. It is disabled by default, and you should leave it that way. If you want to give a visitor or an occasional user access to the system, create an account for that person, and then delete the account when it is no longer needed.\ \ As I said earlier, a group is an account that contains other accounts, and a group is defined by function. Using groups, an administrator can easily create collections of users who all have identical privileges. By default, every Windows XP Professional system contains the following built-in groups:\ Administrators Can do just about anything to the computer. The things that they can do that no other type of user can do include loading and unloading device drivers, managing security audit functions, and taking ownership of files and other objects.\ Backup Operators Can log onto the computer and run backups or perform restores. You might put someone in this group if you wanted them to be able to get on your system and run backups but not to have complete administrative control. Backup operators can also shut down the system but cannot change security settings.\ Guests Have minimal access to network resources. As I mentioned earlier, creating user accounts for occasional users is a much safer bet than using Guest accounts.\ Network Configuration Operators Can manage network configuration with administrativetype access. Although they do not have administrative access to your system, these users can modify network and dial-up connections.\ Power Users Can create new printer and file shares, change the system time, force the system to shut down from another system, and change priorities of processes in the system. They can't run backups, load or unload device drivers, or take ownership.\ Remote Desktop Users Have the right to log on remotely.\ Replicator Enables your computer to receive replicated files from a server machine.\ Users Can run programs and access data on a computer, shut it down, and access data on the computer from over the network. Users cannot share folders or create local printers.\ HelpServicesGroup A group of users for the Help and Support Center.\ IIS_WPG The Internet Information Services Worker Process Group; this group is available only if you have installed IIS. A member of this group can manage the IIS Web server (not content, just service).\ \ Understanding User Rights\ But what's this about shutting down the machine or loading and unloading drivers? Well, actually, the notion of a user right is an integral part of how Windows XP Professional security works. Basically, the difference between regular old users and administrators lies in the kinds of actions that they can perform; for example, administrators can create new user accounts but regular old users cannot. In Windows XP Professional terminology, the ability to perform a particular function is a user right. To take a look at the user rights in Windows XP Professional and the types of users to whom they are assigned, follow these steps...

Ch. 1Introducing Windows XP ProfessionalCh. 2Installing Windows XP ProfessionalCh. 3Using the desktop and getting helpCh. 4Customizing the interfaceCh. 5Installing, running, and managing applicationsCh. 6Using Windows XP Professional on notebook PCsCh. 7Managing files and foldersCh. 8Installing and working with printers and fontsCh. 9Installing and configuring hardwareCh. 10Windows Media PlayerCh. 11Digital Media and Movie MakerCh. 12Connecting to the InternetCh. 13Web browsing with Internet ExplorerCh. 14Using the communications programsCh. 15Using Outlook Express for e-mail and newsCh. 16Windows XP Professional networking and network design primerCh. 17Setting up and configuring your own small networkCh. 18Wireless networkingCh. 19Windows XP securityCh. 20Connecting to domainsCh. 21Working with Windows Server 2003Ch. 22Connecting to non-Microsoft networksCh. 23Administrative and diagnostic toolsCh. 24Active directory essentialsCh. 25Understanding and using the registryCh. 26Scripts for automationCh. 27Disaster prevention and recoveryCh. 28Auditing securityCh. 29Secure telecommutingCh. 30The Microsoft management consoleCh. 31Managing Windows XP Professional servicesCh. 32Hosting Web/FTP serversCh. 33Advanced troubleshooting methodology

\ From Barnes & NobleThe Barnes & Noble Review\ Are you a WinXP power user? Do you administer Windows computers? Just want to run Windows more productively and securely? You need Mark Minasi’s Mastering Windows XP Professional, Third Edition. Minasi tells you the real deal: how things really work (or don’t). He’s taught serious Windows topics to thousands of pros worldwide; so many folks crowded into his recent PC tuning webcast, he crashed Yahoo’s servers. \ His XP Pro book covers everything the others don’t, from secure telecommuting to connecting with Server 2003 domains to the Registry. It also covers everything the others do cover -- only better. (Digital media. Internet Explorer. Troubleshooting.) This edition’s multiple improvements include an entire new chapter on security with SP2, and another on wireless networking -- both part of a whole new section on home/small office networking. Bill Camarda\ Bill Camarda is a consultant, writer, and web/multimedia content developer. His 15 books include Special Edition Using Word 2003 and Upgrading & Fixing Networks for Dummies, Second Edition.\ \ \