Chapter 4
User Management
1
Managing Users, Computers, and Groups
User accounts
Creation, maintenance, passwords
Group accounts
Assign network rights and permissions to multiple
users
Support e-mail distribution lists
Computer accounts
Active Directory tools and utilities used to create
and maintain computer accounts
2
User management
• User management is about interfacing
humans to computers. This brings to light a
number of issues:
– Accounting: registering new users and deleting old
ones.
– Support services.
– Ethical issues.
– Trust management and security
3
User registration
• One of the first issues on a new host is to issue accounts for users.
• For small organizations, user registration is a relatively simple
matter.
• Users can be registered at a centralized location by the system
manager, and made available to all of the hosts in the network by
some sharing mechanism, such as a login server, distributed
authentication service or by direct copying of the data
• For larger organizations, with many departments, user registration is
complicated
4
Creating User Accounts
Domain accounts names must be unique within the
domain, although the same logon name can be used on
several systems with local logon.
Logon names are not case sensitive, must not contain
more than 20 chars, and must not contain:
+,*,?,<,>,/,\,[,],:,;.
Passwords are case sensitive, must be secure – not easy to
guess
5
User Profiles
Profiles customize user environment, store
profiles on server (roaming), restrict changes
through mandatory profiles
Local profiles are stored on a computer when
each user logs in.
6
Local and network accounts
• Most organizations need a system for centralizing
passwords, so that each user will have the same
password on each host on the network.
– Local accounts: a user has permission to use only the
local host. it is configured on local host it self.
– Network accounts: a user can use any host which
belongs to a network domain.
7
Local Accounts
Maintained on the local system, not distributed to
other systems
Local user account authenticates the user for local
machine access only; access to resources on other
computers is not supported.
Built-in local accounts: Guest; Administrator
8
Domain User Accounts
Permit access throughout a domain and provide
centralized user administration through AD
Created within a domain container in AD database and
propagated to all other DCs
Once authenticated against AD database using GC, a user
obtains an access token for the logon session, which
determines permissions to all resources in the domain
9
Deleting User
Deleting account – permanently removes it, and all if
its group memberships, permissions and user rights.
The new account with the same name has different
SID and GUID
Disabling an account may be a better option!
Administrator and Guest can be renamed, but not
deleted
10
Groups of users
• A group is an association of usernames which can be
referred to collectively by a single name.
– Both Linux and Windows allow users to belong to
multiple groups
– File and process permissions can be granted to a
group of users.
• Groups are defined statically by the system administrator
• On Unix-like systems they are defined in the /etc/group
file
11
Cont …
Some standard groups are defined by the
system,
• Administrators
• Users
• Guest
The Administrators group has privileged
access to the system.
12
Group Accounts
Rights and privileges are assigned at the group
level
Groups can be nested (membership by
inheritance)
User’s rights and privileges through group
memberships are cumulative
13
Cont’d
Scope of influence (or scope)
Reach of a group for gaining access to resources in
Active Directory
Types of groups and associated scopes:
• Local
• Domain local
• Global
• Universal Groups
14
Local Groups
Local security group
Used to manage resources on a stand-alone computer that is
not part of a domain and on member servers in a domain
(non-DCs)
Create using the Local Users and Groups MMC snap-in
15
Domain local group
Domain local security group
Used when Active Directory is deployed
Manage resources in a domain
Give global groups from the same and other domains
access to those resources
Scope of a domain local group
Domain in which the group exists
Can convert a domain local group to a universal group
16
Global Groups
Contain user accounts from a single domain
Can also be set up as a member of a domain local group in the
same or another domain
Broader scope than domain local groups can be nested
Typical use:
Add accounts that need access to resources in the same or in
another domain
Make the global group in one domain a member of a domain
local group in the same or another domain
17
Universal Groups
Universal security groups
Span domains and trees
Can include
User accounts from any domain
Global groups from any domain
Other universal groups from any domain
18
Group Strategy
Put users into global domain group.
A global group can be thought of as an Accounts group.
Put resources into domain local (or machine local) groups.
A local group can be thought of as a Resource group.
Put a global group into any domain local (or machine local)
group in the forest
Assign permissions for accessing resources to the domain local
(or machine local) groups that contain them
Use Universal groups to grant access to resources in multi-
domain environments where access is needed across domain
trees.
19
Account policy
• Most organizations need a strict policy for
assigning accounts and opening the system for
users
– Policy rules are required for guiding user behavior, and
also for making system rules clear.
• an account policy should contain:
– Rules about what users are allowed/not allowed to do.
– Specifications of what mandatory enforcement users
can expect, e.g. cleanup of garbage files
– Any account policy should contain a clause about
weak passwords.
20
Support policy
• The amount of support that one offers users is a matter
of policy.
• One has the choice between supporting users directly,
and investing time in making them self-sufficient.
Which of these two strategies depends on the nature of
the problem.
– Support can be directly or by making users self-sufficient
via
Training users
Helping users
Documenting and providing the answers to frequently
asked questions (FAQs)
21
User support services
• All users require help at some time or
another
• normal users are not privileged users
means that they must occasionally rely
on a super user to clean up a mess, or fix
a problem which is beyond their control.
22
Overview of Active Directory Domain Services
• The AD DS database stores information on user identity,
computers, groups, services, and resources.
• AD DS domain controllers also host the service that
authenticates user and computer accounts when they sign
in to the domain.
• AD DS is the primary means by which you can configure
and manage user and computer accounts on your network.
23
Cont’d
• AD DS is composed of both logical and physical components.
• You need to understand the way the components of AD DS
work together so that you can manage your infrastructure
efficiently.
• In addition, you can use many other AD DS options to perform
actions such as
Installing, configuring, and updating apps
Managing the security infrastructure
Enabling Remote Access and Direct Access
Issuing and managing digital certificates
24
Cont’d
• One of the most used AD DS features is Group
Policy, which enables you to configure
centralized policies that you can use to manage
most objects in AD DS.
• Understanding the various AD DS components is
important to using Group Policy successfully.
25
What Are AD DS Domains?
• The AD DS Domain Contains User, Computers,
Groups.
• An AD DS domain is a logical container used to
manage user, computer, group, and other objects.
• All of the domain objects are stored in the AD DS
database, a copy of which is stored on each domain
controller.
• There are many types of objects in the AD DS
database, including user accounts, computer accounts,
and groups.
26
Cont’d
• The following list briefly describes these three object types:
User accounts. User accounts contain the information
required to authenticate a user during the sign-in process
and build the user's access token.
Computer accounts. Each domain-joined computer has an
account in AD DS. Computer accounts are used for
domain-joined computers in the same ways that user
accounts are used for users.
Groups. Groups are used to organize users or computers to
make it easier to manage permissions and group policy in
the domain.
27
Cont’d
• AD DS is composed of both logical and physical components.
• You need to understand the way the components of AD DS work
together so that you can manage your infrastructure efficiently.
28
Logical Components
• AD DS logical components are structures that you use to implement an Active Directory design that is
appropriate for an organization.
• The following table describes the types of logical structures that an Active Directory database contain.
29
Physical Components
30