Chapter 20: Living with Windows XP Professional Strict Security
In the previous chapter, I walked you through the steps for creating and configuring a network, but one big piece of the networking pie is still missing: securing the resources on your network. From its inception, the NT family of operating systems was designed with security as a primary feature, and, of course, this architectural element is omnipresent in the Windows XP Professional.
Unlike some other operating systems, Windows XP Professional requires you to create a user account for yourself right on your PC before you can do anything on that PC. Yes, the idea that you must create your own user account on your personal PC before you can do anything with the PC is unusual-after all, most of us are accustomed to requiring network accounts, but not particular accounts on a workstation. But-as your father might say when you complain that something you don't like isn't fair-get used to it!
The user account is an integral part of Windows XP Professional and has some great benefits. For example, suppose you and Sue share a computer. You can set up the computer so that you own a folder on the hard disk and Sue owns another folder on the hard disk, and it is completely impossible for Sue to access your data (and vice versa) unless you give her permission.
In addition, you can restrict access to files and folders by setting permissions. As you may recall, in Windows XP Professional you can use the FAT, FAT32, or NTFS file system. If you use either FAT system, you can exercise only a limited amount of control over file and folder access, but if you use the NTFS system, you can exercise a great deal of control-whether the files are on your local computer or on your network.
In this chapter, we'll first look at how to set up user accounts, and then we'll look in detail at establishing permissions for shares, files, and folders.
In this chapter:
- Understanding and creating accounts in Windows XP Professional
- Setting permissions
- Understanding ownership
Understanding User Accounts in Windows XP Professional
As you have just read, you must create separate user accounts on a Windows XP Professional machine before any user can log on to the workstation-and, unlike Windows 9x, Windows XP Professional won't let you get anywhere until you log on.
If your computer is part of a Windows XP Professional client-server network, two types of user accounts are available: domain accounts and local accounts. A domain account gives you access to the network and to the network resources for which you have permission. The manager of the server normally sets up domain accounts, which are stored in a directory on the server. The directory can either be Active Directory or a Windows NT domain directory.
A local user account is valid only on your local computer; local user accounts sit in a database called the Security Accounts Manager, or SAM. You create user accounts with the Users and Passwords applet, which you'll meet later in this chapter.
In this chapter, I'm going to talk about local user accounts only. If you happen to be the administrator of a domain on a network and you need help creating domain user accounts, take a look at Mastering Windows 2000 Server, Third Edition (Sybex, 2001).
Before I get into how you change or create an account, we need to look at the types of accounts in Windows XP Professional. The two broad categories are users and groups. A user account identifies a user on the basis of their user name and password. A group account contains other accounts, and these accounts share common privileges.
User accounts are of three types:
Computer Administrator This account has full and complete rights to the computer and can do just about anything to the computer. The Computer Administrator account was created during installation and setup of Windows XP Professional. The Computer Administrator account cannot be deleted. You'll need to log on as Computer Administrator when you want to create new accounts, take ownership of files or other objects, install software that will be available to all users, and so on.
Limited This account is intended for use by regular old users, those who should not be allowed to install software or hardware or change their user name. Someone with a limited account can change their password and logon picture.
Guest This built-in account allows a user to log on to the computer even though the user does not have an account. No password is associated with the Guest account. It is disabled by default, and you should leave it that way. If you want to give a visitor or an occasional user access to the system, create an account for that person, and then delete the account when it is no longer needed.
As I said earlier, a group is an account that contains other accounts, and a group is defined by function. Using groups, an administrator can easily create collections of users who all have
identical privileges. By default, every Windows XP Professional system contains the following built-in groups:
Administrators Can do just about anything to the computer. The things that they can do that no other type of user can do include loading and unloading device drivers, managing security audit functions, and taking ownership of files and other objects.
Backup Operators Can log onto the computer and run backups or perform restores. You might put someone in this group if you wanted them to be able to get on your system and run backups but not to have complete administrative control. Backup operators can also shut down the system but cannot change security settings.
Guests Have minimal access to network resources. As I mentioned earlier, creating user accounts for occasional users is a much safer bet than using Guest accounts.
Network Configuration Operators Can manage network configuration with administrativetype access. Although they do not have administrative access to your system, these users can modify network and dial-up connections.
Power Users Can create new printer and file shares, change the system time, force the system to shut down from another system, and change priorities of processes in the system. They can't run backups, load or unload device drivers, or take ownership.
Remote Desktop Users Have the right to log on remotely.
Replicator Enables your computer to receive replicated files from a server machine.
Users Can run programs and access data on a computer, shut it down, and access data on the computer from over the network. Users cannot share folders or create local printers.
HelpServicesGroup A group of users for the Help and Support Center.
IIS_WPG The Internet Information Services Worker Process Group; this group is available only if you have installed IIS. A member of this group can manage the IIS Web server (not content, just service).
Understanding User Rights
But what's this about shutting down the machine or loading and unloading drivers? Well, actually, the notion of a user right
is an integral part of how Windows XP Professional security works. Basically, the difference between regular old users and administrators lies in the kinds of actions that they can perform; for example, administrators can create new user accounts but regular old users cannot. In Windows XP Professional terminology, the ability to perform a particular function is a user right. To take a look at the user rights in Windows XP Professional and the types of users to whom they are assigned, follow these steps...