User Access and Account Management
RBAC
● Role-Based Access Control − is a security paradigm where access permissions are assigned to roles,
and users are assigned to those roles. This simplifies management and enhances security.
● Concepts
★ Role: A collection of permissions tied to job function
★ Permission: Authorization to perform specific actions
★ User: An individual account assign one or more roles
RBAC Principles
Least Privilege: Users get only permissions they need to perform their job.
Separation of Duties: Critical tasks are split among roles to prevent abuse
Auditability: Roles and permissions are easier to track and audit.
Implementation in Windows Server
● Users
- Created in Active Directory or locally
● Groups
- Logical containers for users with similar roles
Group Type Purpose
Security Group Used to assign permissions to resources
Distribution Group Used for email distribution (not for access control)
Access Level
Windows uses NTFS (New Technology File System) to control access to files and folders.
Access Level What It Means
Read View only, no changes allowed
Write Add new data but not change existing ones
Modify Edit existing data
Full Control Do everything: read, write, delete, manage
Implementation in Windows Server
• Build-in Roles and Delegation
Windows Server includes built-in roles like:
− Administrators: Full control over the system
− Backup Operators: Can back up files even if denied access
− Remote Desktop Users: Can log in remotely
• Group Policy (GPO)
− allows centralized management of user and computer settings.
− You can enforce access rules, desktop restrictions, software installations, Etc.
GPOs are linked to Organizational Units (OUs) in Active Directory.
Authentication Methods
Authentication is the process of verifying the identity of a user or system before granting access to resources.
• Methods
- Single-Factor Authentication (SFA) : one method
- Two-Factor Authentication (2FA): combines two methods (password + smartcard)
- Multi-Factor Authentication(MFA): uses two or more of the following
Knowledge: Something you know (password, PIN)
Possession: Something you have (RFID Card, token)
Inherence: Something you are (biometric)
Windows Server 2019 Implementation:
Authorization Principles
Authorization determines what actions a user can perform after authentication.
• Core Principles
- Role-Based Access Control (RBAC): Assign permissions to roles/groups, not individuals.
- Least Privilege: Users get only the access they need to perform their job.
- Separation of Duties: Divide responsibilities to reduce risk (e.g., no single user can approve and execute
payments).
- Time-Bound Access: Temporary permissions for contractors or special tasks.
Windows Server 2019 Implementation:
Account Life Cycle Management
Account lifecycle management ensures that user accounts are created, maintained, and retired securely and
efficiently.
Windows Server 2019 Implementation