Understanding user profiles

A user profile defines customized desktop environments, which include individual display settings, network and printer connections, and other specified settings. You or your system administrator may define your desktop environment.

Local Users and Groups overview

Local Users and Groups is a tool you can use to manage local users and groups. It is available on computers running Windows 2000 Professional and member servers running Windows 2000 Server.

A local user or group is an account that can be granted permissions and rights from your computer. Domain or global users and groups are managed by your network administrator. You can add local users, global users, and global groups to local groups. However, you cannot add local users and groups to global groups.

Users and groups are important in Windows 2000 security because you can limit the ability of users and groups to perform certain actions by assigning them rights and permissions. A right authorizes a user to perform certain actions on a computer, such as backing up files and folders or shutting down a computer. A permission is a rule associated with an object (usually a file, folder, or printer), and it regulates which users can have access to the object and in what manner.

When you create new user accounts and assign them to groups, there are important security consequences. It is highly recommended that you review the information on the security settings for Windows 2000 before you create or modify user accounts. Microsoft provides an explanation on this web site:

http://windows.microsoft.com/windows2000/en/professional/help/default.asp?PaneName=Search&ShowPane=true&TopicUrl=http%3A//windows.microsoft.com/windows2000/en/professional/help/default.htm

Local Users and Groups is not available on domain controllers. Use Active Directory Users and Computers to manage global users and groups.

• Local Users and Groups overview
• Users overview
• Groups overview
• Create a new user account
• Configure a user profile
• Create a new local group
• Default security settings
• Working with MMC console files

The five options administrators have in assigning passwords to users:

• User Must Change Password at Next Logon. User sets own password from what the Administrator has set.
• User Cannot Change Password. Only the administrator can change the user’s password.
• Password Never Expires. The Windows 2000 default forces users to change their passwords every 42 days. This option removes the expiration process.
• Account Disabled. User cannot log on until administrator re-enables the account.
• Account Locked Out. If user triggers an account to lock out, it remains locked out according to established Group Policies.

The three accounts that Windows 2000 establishes on installation (shown on the Users and Passwords dialog box):

• Administrator’s personal account with full permissions.
• Administrator account with password used during the installation process; also assigned Administrator permissions.
• Guest account, with no password.

B. Configuring a User Profile

Exercise 9-2 on page 501 walks through the process of adding a user to a group (see "Local Users and Groups" above). Go right on to Exercise 9-3 on page 503 to show how to remove a user. Note the importance of security within groups in the Active Directory for defining user privileges. Refer to the Exam Watch on page 504 which explains the fact that user accounts are actually identified by their security ID (SID). What is the effect of deleting a user and the effect on the SID.

Microsoft’s web page describes three types of user profiles.

Types of user profiles include:

A local user profile, which is created the first time you log on to a computer and is stored on a computer's local hard disk. Any changes made to your local user profile will be specific to the computer in which you made the changes.

A roaming user profile, which is created by your system administrator, is stored on a server. This profile is available every time you log on to any computer on the network. Any changes made to your roaming user profile will be updated on the server.

A mandatory user profile, which is a roaming profile that can be used to specify particular settings for individuals, or an entire group of users. Only system administrators can make changes to mandatory user profiles. Options:

• Copy a user profile
• Delete a user profile
• Switch between a roaming and local user profile

Configuring for a group requires using a Group Policy snap-in. Exercise 9-5 on page 511 shows how to create a Group Policy icon for use with the MMC.

A. Setting Policy

Figure 9-8 on page 514 provides a list of tasks that can be set as policy. However, it is your company or organization that determines what policies are put in place.

1. Start menu and Taskbar Settings are the two areas where policies are most prevalent. Figure 9-11 on page 517 displays a list of those properties, and they are described in the text.

• Remove user’s folders from Start Menu.
• Disable programs on Settings menu.
• Remove X from Start Menu.
• Add Logoff to the Start Menu.
• Disable and remove the Shut Down command.
• Disable changes to Taskbar and Start Menu settings.
• Disable personalized menus.

    2.  Desktop settings are shown in Figure 9-12 on page 519 and also described in the text:

You never know when you’ll have a physically disadvantaged user, and Windows 2000 has anticipated this with its well-developed accessibility services.

Microsoft provides a catalog of accessibility aids that can be used with the Windows operating systems. You can obtain this catalog from the web site or by phone:

Microsoft Sales Information Center
One Microsoft Way
Redmond, WA 98052-6393
World Wide Web: http://microsoft.com/enable/
Voice telephone: (800) 426-9400
Text telephone: (800) 892-5234