dcsimg

70-240 in 15 minutes a week: Administration of Resources - Part 1 Page 3

By ServerWatch Staff (Send Email)
Posted Mar 19, 2001


User and group Settings

In Windows 2000 Professional, users and groups are created using the Computer Management tool's Users and Groups extension. By default, W2K Pro still only includes two user accounts by default, Administrator and Guest. Similar to NT 4, the Guest account is disabled by default. Both accounts can be renamed, though neither can be deleted. A number of built-in groups also exist by default, some of which allow you to control membership (local groups), and some of which control membership automatically (system groups). The table below outlines the built-in groups you will find, but of course you can still create your own local groups.

 Built-in Local Groups  Built-in System Groups
 Administrators  Anonymous Logon
 Backup Operators  Authenticated Users
 Guests   Creator Owner
 Power Users  Dialup
 Replicator  Everyone
 Users  Interactive
   Network

File Auditing and Ownership

File and folder auditing and the concept of file ownership still also exist when (and only when) we use the NTFS file system. This is important to consider, especially because you may have trouble finding where things get set up in Windows 2000. To begin, ownership and auditing settings are found behind the Advanced button on the security tab of the properties of a file or folder on an NTFS volume. 

Audit settings for a particular file or folder are controlled from the Auditing tab of that resource. This only controls what elements of this resource you wish to audit, similar to NT 4. Auditing, however, is not enabled by default of a Windows 2000 Professional system, so if you wish to audit files and folders, you must first create an Audit Policy. In W2K Pro, this is now done via the Local Security Settings console (which can also be accessed from within the Group Policy tool). Audit Policy settings are shown in the screenshot below. 

The concept of ownership remains very similar to that of Windows NT 4. It is now controlled from the Owner tab of the advanced security settings of a file or folder. Simply, the person who creates a file is the owner, and can always change permissions on that file. However, anyone with Full Control or the advanced permission Take Ownership can take ownership of a file or folder. The exception to this rule is a person with administrator-level privileges, who can always take ownership, even if they have no NTFS permissions to a file or folder. Ownership can still only be taken and not given.



Comment and Contribute

Your name/nickname

Your email

(Maximum characters: 1200). You have characters left.