Resource
Page CIS 2149 Syllabus
Student Grade Calculator
Chapter Lesson Notes: 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10
| 11 | 12 Word Lists
Chapter 12 Lesson Notes
Implementing, Monitoring, and Troubleshooting Security and User Accounts
I. Implementing, Configuring, Managing, and Troubleshooting Local Group Policy
As we have learned again and again, group policy is a cornerstone of Windows 2000 administration. The ultimate objective is to set policy, which is a high-level management task. The Group Policy Editor is used for this task. The policies are set at four levels:
Also…
A. Start the Group Policy Editor
Exercise 12-1 on page 648 walks through the use of the Group Policy Editor. Pay attention to the Security Settings in Figure 12-1 on page 649.
B. Account Security Policies
Administrators can determine passwords or let users make up their own. In many respects this is a policy issue. Study the password options shown in Figure 12-2 on page 651.
Users and Passwords overview
Users and Passwords, in Control Panel, allows you to add users to your computer and to add users to a group. In Windows 2000, permissions and user rights usually are granted to groups. By adding a user to a group, you give the user all the permissions and user rights assigned to that group.
C. Account Lockout Policy
The account lockout policy is for domain or local user accounts, and determines when and for whom an account will be locked out of the system. For example, it can be set so that an incorrect password entered x number of times results in a lockout, or that after a specific period of waiting for the correct password the system performs a lockout.
D. Audit Policy
The following are two advanced security features of Windows 2000: Account Lockout Policy shown in Figure 12-4 on page 654 and Audit Policy, shown in Figure 12-5 on page 655.
Auditing is different from administering. Its purpose is an extension of monitoring for the purpose of improving the system and its security for users. The Scenario & Solution on page 659 reviews some auditing practices.
E. User Rights Assignment
Review the key user rights below. Some rights are a restriction or withholding of rights. Figure 12-6 on page 660 shows how to access user rights.
Be sure to review the principles of ownership outlined in From the Classroom on page 661, as this is essential to understanding user rights.
F. Group Policy Configuration
Although this is discussed last in this lesson, in fact Group Policy might best be configured first.
II. Encrypting Data on a Hard Disk by Using EFS
Encryption is a powerful new feature with Windows 2000, and summarize the following points:
The Exam Watch on page 666, which explains how a folder is marked, not actually encrypted.
A. Moving Your Private Key
Users often move from workstation to workstation and need access to their encrypted files. By creating a remote profile, they can move their certificates with them (although you, the administrator, may be asked to help!). An alternate strategy is to create a floppy disk with the certificate for each user.
B. Recovery Agents
This outstanding feature in Windows 2000 permits recovering lost private keys.
C. The Cipher Command
The cipher command line command and its switches can be used to encrypt and un-encrypt.
Summarize the chapter with the Scenario & Solution on page 670.
III. Implementing, Configuring, Managing, and Troubleshooting Local User Accounts
Managing users accounts is about managing rights and permissions, using established policies.
A. Creating and Managing User Accounts
User accounts are created on the Member Server, and usernames can be up to 20 characters in length, helping to reinforce security and privacy.
B. Creating and Managing Computer Accounts
C. Creating and Managing Local Groups
A local group name cannot be the same as any other group name or username on the computer being administered.
IV. Creating and Managing User Authentication
These attributes make each user, and their profile, unique:
There are three kinds of profiles:
Exercise 12-11 on page 681 to demonstrates how to switch between local and roaming profiles.