L-02: Setting up, Configuring and Managing Users and Groups
This is a hands-on exercise to walk you through setting up, configuring and managing users and groups on a single computer. The instructions and screen captures
supplied in this exercise were written for Windows10 image. In completing this exercise, detailed information will be given within this document – however you may
need to revisit Module-03’s lesson from eConestoga and as well, you may need to do some research online for a how-to solution.
By the end of this lab exercise, you will become more familiar with administrating users and groups and their privileges as well as shared network resources. You will
also need to complete some questions along the way … Any questions found within this document are highlighted in cyan – so make sure to take notes and write
down your answers along the way.
Please download and use the “L02 - Lab Observations” document found in eConestoga as the starting point for your lab report. I have copied all of the questions into
this observations document – so you know which questions to answer. When you’re done with the lab – submit your report to the “OSF: L-02 - Playing with Groups /
Permissions Observations” drop-box.
OSF Lab 02 Page 1
Module 03
L-02: Setting up, Configuring and Managing Users and Groups
SELF-DIRECTED LAB PORTION
1. Launching a Virtual Machine (VM) to remove yourself from the College domain
In this portion of the lab, you will be setting up a number of local users (i.e. users local to the actual computer and not part of the College domain).
Because of the group and user policies in place here at the College:
1. You (as a student) are able to create local users and groups and change/set the permissions on these users and groups but
2. You are not able to login to those users!
So instead, once you’ve logged into your own computer, we will begin the lab by launching and utilizing the virtual machine you created in Lab-01. You
should make a copy of this virtual machine to work on.
1. Don’t worry if this is the first time you’ve ever seen or used a VM – we will be learning about them later in the course …
2. For now – simply follow these instructions to launch the VM and then proceed to Step 2 of the lab
Launching the VM
1. Locate the VMWare Player icon (shown to the right here) on the desktop and double-click it
2. Now you want to “Open a Virtual Machine”. This will take you to the “where is your VM?” loading screen
Navigate the files-system to the C:\VM\Win10 folder, or the folder you created your vm in
You should see a file called with the vmx – double-click on this file
Now you are ready to open and run the Windows 10 VM … somewhere on the screen you should see a play button labelled Play Virtual
Machine
When you click the play button, you will see the VMWare Player application loading and boot the Windows 10
NOTE: If any pop-ups show up asking you questions or warning you about something – simply click OK (or whatever the default
option is)
3. You should remember the user you installed the VM with in Lab-01
The remainder of Steps (2 through 5) – will be using this Windows 10 VM.
OSF Lab 02 Page 2
Module 03
L-02: Setting up, Configuring and Managing Users and Groups
2. Setting up a Local Group on a Computer
To setup and configure new users and groups – we need to launch the Computer Management utility within Windows. Simply type
computer management into Cortana. Launch the utility once Cortana has found it
OSF Lab 02 Page 3
Module 03
L-02: Setting up, Configuring and Managing Users and Groups
Expand the Local Users and Groups option in the left hand panel and you will see the two allowable sub-options (i.e. you will see Users and Groups). Now
we want to start by adding a new group (as shown below)
OSF Lab 02 Page 4
Module 03
L-02: Setting up, Configuring and Managing Users and Groups
So let’s create the SETGroup as shown here
This will bring you back to the base User and Group Management area. If you click on the Groups option in the left-hand navigation – you’ll be able to see
the current set of groups configured within the local computer – including the SETGroup!
OSF Lab 02 Page 5
Module 03
L-02: Setting up, Configuring and Managing Users and Groups
3. Setting up a Local Users on a Computer
Now using the base User and Group Management area, we’re going to set-up two users: SETUser3 and SETUser4. This done by following the instructions
as shown here. Note that the passwords for these accounts have been set to the same value as the user name.
Performing these actions simply adds the users – we have not placed these users into any groups. At this point, they are simply local users.
OSF Lab 02 Page 6
Module 03
L-02: Setting up, Configuring and Managing Users and Groups
4. Adding Users to Groups
Still using the base User and Group Management area – once again focus on the Groups and perform the operation as shown below
OSF Lab 02 Page 7
Module 03
L-02: Setting up, Configuring and Managing Users and Groups
Now we want to add the local user known as SETUser3 to the local groups known as SETGroup. Only SETUser3 is added to the SETGroup group.
We can enter the user name and check it – as shown here. Notice that once you check the name (by clicking the Check Names button), it actually changes
in the object name text area to a fully qualified user name in the format [computer-name]\[user-name] (or WINDEV1808EVAL\SetUser3 in my
example)
OSF Lab 02 Page 8
Module 03
L-02: Setting up, Configuring and Managing Users and Groups
Once you clicked on the Check Names button and seen the fully qualified name of the SETUser3 user on your computer, click on the OK
[Link] will return you to the main User and Group manager. Check that SETUser3 is actually part of the SETGroup by double clicking on
the
SETGroup entry in the group list. Take a screen capture of this list of users and include it in your lab report / observations.
Now following the same set of operations as above, please add both users (SETUser3 and SETUser4) to the Administrators group on the local computer.
OSF Lab 02 Page 9
Module 03
L-02: Setting up, Configuring and Managing Users and Groups
5. Limiting Access to Local Resources
In the following steps, you will use the two users that you’ve created above to work through the steps needed to limit (or restrict) users from gaining
access to local resources. Since SETUser4 is a member of the Administrators group, they are able to perform these tasks.
So you need to login to the computer as SETUser4 – which means you need to log out from being the “User” within the VM (as shown below)
The nice thing about creating users (and groups) on the VM – where the VM is not actually part of a domain (i.e. the College network) is that when
we sign-out from being the “User” and we want to login as SETUser4, you have the list of allowable users on the main login screen as shown here.
OSF Lab 02 Page 10
Module 03
L-02: Setting up, Configuring and Managing Users and Groups
Now using File Explorer, create a directory (or folder) called SETTemp in the root of C:
1. Let's look at this folder's permissions - right-click on the folder and select Properties. Select the "Security" tab. You will notice that in the top half
of this pop-up window (shown below), the user called SETUser4 is not even mentioned ... curious ...
OSF Lab 02 Page 11
Module 03
L-02: Setting up, Configuring and Managing Users and Groups
Instead, there are "Authenticated Users", "SYSTEM", "Administrators (<on whatever machine you are logged in on> - e.g.
WINDEV1808EVAL\Administrators)" and "Users (again on whatever machine you are logged in on)"
2. Let’s have a closer look at the users and permission on this SETTemp folder … click on the "Advanced" button (in the bottom half of the pop-up)
as shown below … follow the instructions in image below
OSF Lab 02 Page 12
Module 03
L-02: Setting up, Configuring and Managing Users and Groups
OSF Lab 02 Page 13
Module 03
L-02: Setting up, Configuring and Managing Users and Groups
When you click on the Check Names button in Step 4 above - you should see this
.
Click OK and return to the previous window – then press the Apply button as well as any OK buttons in order to back your way out of the
folder properties
Now let's test that the SETUser4 user actually "owns" and has full access to the folder that it just created (and technically owns). Recall that you are
currently logged into the computer as SETUser4
1. Open notepad on the computer
You can do this by clicking the Windows button and enter “notepad” in the search program and files textbox and launching the program it
finds
Or you can click the Windows button, click All Programs, go to Accessories and find Notepad there
2. Enter a few lines of text into notepad – it doesn’t matter what
3. Click on the File menu and select the Save-As option and save the contents into a file called [Link] in the C:\SETTemp folder
a. Were you able to save the file as SETUser4? If so, then simply say you were able to save the file. If not, then please include a screen
capture of any error message that may have popped up.
Now let's log off the SETUser4 user and switch to the SETUser3 users ... let's see if this user can access and see the contents of the C:\SETTemp folder
1. Following the previous login switch instructions (given in previous steps) - login as SETUser3
2. Open File Explorer and check if you can see the C:\SETTemp folder.
b. Can you? Does this make sense? If you can, tell me why exactly you think that you can see the SETTemp folder (and its contents) when
it was created and is owned by SETUser4. [HINT: It would have to do with the permissions (for the users and groups) on that folder ...
think about it for a while and it will come to you]
Log back in again as SETUser4
1. Find the SETTemp folder again, right-click and get into its Properties. Again - click on the Security tab and then click on the Advanced button
2. Let's try to remove the "Local Administrators" group (e.g. "Administrators (WINDEV1808EVAL\Administrators)") from the list of those users
and groups with permissions. This is shown in the following image:
OSF Lab 02 Page 14
Module 03
L-02: Setting up, Configuring and Managing Users and Groups
OSF Lab 02 Page 15
Module 03
L-02: Setting up, Configuring and Managing Users and Groups
3. But wait ... when you do this (if you've done it correctly) - you'll get an error message (shown below)
4. This error is telling you that you need to disable inherited permissions.
c. What are inherited permissions? What does that mean? Do a little research here (you can start your reading and research at this link) –
you may need to Google around a bit in order to get a good understanding of inherited permissions. I need you to explain (in your own
words) what "inherited permissions" are.
5. After acknowledging this error, click on the disable inheritance button and you will see a fairly scary dialog pop-up (shown here)
Select the "Convert inherited ..." option. When you do this, you really won't see any change in the Advanced Security settings of the
SETTemp folder. But doing this actually now allows you to remove the " Administrators" group as we tried above – click on the
Administrators group now and click the Remove button (as you tried (and failed) previously)
OSF Lab 02 Page 16
Module 03
L-02: Setting up, Configuring and Managing Users and Groups
d. What do you think the “Convert inherited permissions …” option actually did with the inherited permissions on the folder with all of
the users/groups listed? Explain in your own words …
Once you've removed the "Administrators" group - click on Apply and OK buttons to back yourself out of the folder properties
Once again, let’s log off the SETUser4 user and switch to the SETUser3 user ... let's see if this user can still access and see the SETTemp folder
1. Following the previous login switch instructions - login as SETUser3
2. As before, open notepad on the computer and type in some text (doesn't matter what it is) - go to the File menu and click "Save As". Try saving
this file to the C:\SETTemp folder as a file called [Link]
e. Report on your observations:
If you received an error - take a screen capture of the error and include it in your lab report as well as the description of the error.
Why do you think you received the error?
If the file saved to the folder - take a screen shot of the contents of the C:\SETTemp folder and show me the file(s) there. Why
do you think the file saved to the folder? SETUser3 is part of the local Administrators group, but we removed that group's
permissions on this folder ... so why did the file save? Give me a reason and be explicit.
Oh my goodness – how many times do we need to switch between users? Log back in again as SETUser4
1. Let's try to change the permissions on the SETTemp folder again to see the results ... (get back into the Advanced properties (as you did in
the steps above))
2. This time, let's remove the "Local Users" group from having permissions on the folder (this group would be called something like
"Users (WINDEV1808EVAL\Users)")
Once you’ve selected this group and clicked on the Remove button, click on the Apply and OK buttons in order to back yourself out of the
folder properties
Time to switch again! Now let's log off the SETUser4 user and switch to the SETUser3 user ... let's see if this user can still access and see the SETTemp
folder
1. Following the previous login switch instructions - login as SETUser3
2. Open File Explorer and check if you can see the SETTemp folder and its contents.
f. Can you? Does this make sense? Try editing either of the files that should be in the folder (you can edit with notepad) - can you?
If you can, why do you think that you can still access the folder and its contents as the SETUser3 user? (explain)
If you can’t, explain why you believe that you are not able to edit the file?
Let’s try this one more time … log back in again as SETUser4
1. Let's try to change the permissions on the SETTemp folder again to see the results ... (get back into the Advanced properties (as you did in
the steps above))
2. This time, let's remove the "Authenticated Users" group from having permissions on the folder
g. What users exactly do you think this group contains? What does this group name imply? Is it possible that both the SETUser3 and
SETUser4 users are part of this group?
Once you’ve selected this group and clicked on the Remove button, click on the "Apply" and "OK" buttons in order to back yourself out of
the folder properties
We’re getting good at switching logins … log off the SETUser4 user and switch to the SETUser3 user ... let's see if this user can still access and see the
SETTemp folder
OSF Lab 02 Page 17
Module 03
L-02: Setting up, Configuring and Managing Users and Groups
1. Following the previous login switch instructions - login as SETUser3
2. Open File Explorer and check if you can see the SETTemp folder and its contents.
h. Can you see the contents of the folder? Tell me if you can. Does this make sense?
If you can - take a screen capture of the folder contents and include it in your lab report.
If you cannot - again take a screen capture of any error message that you may get and include it in your lab report.
One last check - let's log back in as SETUser4 and ensure that it can still see and access the SETTemp folder
1. following the previous login switch instructions - login as SETUser4
it is important to remember here that we have removed the Local Users, Local Administrators and also the Authenticated User groups …
but SETUser4 has a special relationship with the SETTemp folder that we setup earlier in this section …
i. Once again, open File Explorer and check if you can see the SETTemp folder and its contents.
Take screen captures of any warnings/errors you may see as you try to access the folder and include in your report
Can you see the contents of the folder? Tell me if you can …
If you can
Then using notepad, edit another file and save it to the SETTemp folder as a file called [Link]
Take a screen capture of the folder contents and include it in your lab report.
As a final act on this folder, try to delete the SETTemp folder from the C: drive. Can you do this as SETUser4? If so, why do
you think that you can delete it? If you cannot delete it - why do you think this is the case?
If you cannot - again take a screen capture of any error message that you may get and include it in your lab report.
OSF Lab 02 Page 18
Module 03