Configuring Windows 7 (Training Kit) - Part 51 pdf

Case Scenarios CHAPTER 8 473 Chapter Review To further practice and reinforce the skills you learned in this chapter, you can perform the following tasks: n Review the chapter summary. n Review the list of key terms introduced in this chapter. n Complete the case scenarios. These scenarios set up real-world situations involving the topics of this chapter and ask you to create a solution. n Complete the suggested practices. n Take a practice test. Chapter Summary n HomeGroups allow for the sharing of resources on home networks. n You can manage shared folders centrally using the Computer Management console. n Libraries are virtual collections of folders that host similar content. n NTFS permissions determine which files a user or group can access on a computer. n Print permissions determine what rights a user has to manage a printer or documents. n BranchCache is a technology that speeds up branch office access to files in remote locations through the caching of previously accessed files on the branch office network. Key Terms Do you know what these key terms mean? You can check your answers by looking up the terms in the glossary at the end of the book. n BranchCache n Encrypting File System (EFS) n HomeGroup n library Case Scenarios In the following case scenarios, you apply what you’ve learned about subjects covered in this chapter. You can find answers to these questions in the “Answers” section at the end of this book. 4 7 4 CHAPTER 8 BranchCache and Resource Sharing Case Scenario 1: Permissions and Encryption A computer running Windows 7 Enterprise named Waverley has two NTFS-formatted volumes, volume C and volume D. The folder C:\Share is shared and has 15 subfolders and hundreds of files. Many of these folders have unique NTFS permissions. You want to move this folder so that it is hosted on volume D because volume C is running out of space. One of the users of computer Waverley will be changing to computer Warrandyte. This user has copied a large number of EFS-encrypted files onto a NTFS-formatted USB flash device. With these facts in mind, answer the following questions: 1. What steps can you take so that the user is able to read the encrypted files on the USB flash device on computer Warrandyte? 2. What steps can you take to ensure that it is possible to recover all files that are encrypted in future? 3. What steps can you take to move the shared folder to volume D? Case Scenario 2: Configuring Contoso Branch Offices You are trying to make the use of WAN bandwidth between Contoso’s head office in Melbourne and branch offices in Wangaratta and Traralgon more efficient. All client computers at Contoso have Windows 7 Enterprise installed. Users turn their computers on and off during the day. If possible, you want to store any BranchCache data so that it is always available. There is a Windows Server 2008 R2 RODC at the Traralgon site named rodc.traralgon.contoso.internal, and there is a Windows Server 2008 RODC named rodc. wangaratta.contoso.internal at the Wangaratta site. You do not plan on upgrading any server operating systems in the near future. With these facts in mind, answer the following questions: 1. Which BranchCache mode should you use at the Wangaratta branch office? 2. Which BranchCache mode should you use at the Traralgon branch office? 3. What steps do you need to take to prepare server rodc.traralgon.contoso.internal to support BranchCache? Suggested Practices To help you master the exam objectives presented in this chapter, complete the following tasks. Configure Shared Resources Perform this practice when logged on to computer Canberra with the Kim_Akers user account. Take a Practice Test CHAPTER 8 475 n Configure a shared printer. Create a local group named PrinterManagers and assign the Manage Printers permission to this group. Configure File and Folder Access Perform both of these practices when logged on to computer Canberra with the Kim_Akers user account. n Practice 1 Use Gpedit.msc and Cipher.exe to configure and assign an EFS recovery agent certificate. n Practice 2 Create a file named Gamma.txt. Use Icacls.exe to assign the Modify (Deny) permission to the file. Use Robocopy.exe to copy Gamma.txt to a new folder while retaining its original permissions. Configure BranchCache Perform this practice when logged on to computer Canberra with the Kim_Akers user account. n Configure computer Canberra using the Netsh command to use local caching only. Take a Practice Test The practice tests on this book’s companion DVD offer many options. For example, you can test yourself on just one exam objective, or you can test yourself on all the 70-680 certification exam content. You can set up the test so that it closely simulates the experience of taking a certification exam, or you can set it up in study mode so that you can look at the correct answers and explanations after you answer each question. More Info PRACTICE TESTS For details about all the practice test options available, see the section entitled “How to Use the Practice Tests,” in the Introduction to this book. CHAPTER 9 477 CHAPTER 9 Authentication and Account Control U ser Account Control (UAC) is a tool for administrators that alerts you to the fact that what you are trying to do requires administrator privileges. You should not be surprised to encounter a UAC prompt when modifying firewall rules. You would be justifiably wary if you encounter a UAC prompt when trying to open a picture of a cat eating a cheeseburger sent to you by your aunt. One of these tasks should require administrator privileges and one of them should not. UAC can protect your computer from malware because it allows you to notice when a program or document that should not require administrative privileges requests them. UAC rarely affects normal users because, by definition, normal users should not be doing anything that requires administrator privileges. In the first part of this chapter, you learn how to configure UAC for your environment so that it warns you when necessary but keeps out of your way the rest of the time. Passwords are the primary method through which you secure a computer running Windows 7. The strength of a password is directly proportional to the strength of the security it provides. If passwords are not secure enough for your environment, you can configure Windows 7 to require a smart card before it allows users to log on. Privileges allow users to perform tasks. You can assign privileges, such as allowing a user to back up a computer in its entirety by adding them to the appropriate group or by configuring the appropriate Group Policy. In the second part of this chapter, you learn how to configure password policies, resolve authentication problems, assign privileges, and back up and restore saved credentials. Exam objectives in this chapter: n Configure User Account Control (UAC). n Configure authentication and authorization. Lessons in this chapter: n Lesson 1: Managing User Account Control 479 n Lesson 2: Windows 7 Authentication and Authorization 493 4 7 8 CHAPTER 9 Authentication and Account Control Before You Begin To complete the exercises in the practices in this chapter, you need to have done the following: n Installed Windows 7 on a stand-alone client PC named Canberra, as described in Chapter 1, “Install, Migrate, or Upgrade to Windows 7.” real World Orin Thomas T he UAC prompt doesn’t appear capriciously. UAC lets you know if software is doing something suspicious. If you are messing around with the guts of your operating system, you should expect a couple of UAC prompts. This is because you are making substantive changes to the operating system, and you need administrator privileges to do that. However, if you are doing something normal with your computer, such as playing a game or running a word processor (something that shouldn’t require administrative privileges), and you are prompted by UAC, your first thought shouldn’t be “Oh, not that annoying prompt again!” You should be thinking, “Now what on Earth made it do that?” Normal programs do not require administrative privileges to run. This is the key thing to understand about UAC. If UAC does interrupt when you are doing something that isn’t related to your computer configuration, you should get suspicious. UAC is a red flag, a warning you should pay attention to. UAC is the computer’s way of asking you, “Are you sure you want to let this program have administrative rights?” The answer to this question is important. To take control of your computer, malware needs to elevate its privileges so that it can run with administrative rights. Malware authors have a whole bag of tricks that they use to try to get you to run their programs. Sometimes malware try to get you to execute it by piggybacking on another program that you run on a regular basis. You run the program, thinking it is something else and then bang, pwnd! UAC cannot stop you from running the malware, but it warns you when the program tries to do something that requires admin privileges. If you do get prompted when you are doing something that you should be able to do without administrator rights, UAC lets you proceed if you so choose. Of course, if your computer does end up infected with malware, you won’t be able to say that you weren’t warned. Lesson 1: Managing User Account Control CHAPTER 9 479 Lesson 1: Managing User Account Control User Account Control (UAC) is a tool that you will likely use only if your user account is a member of the local administrators group. This is because UAC is disabled by default for standard users, which means that standard users do not, by default, encounter a UAC prompt. UAC settings can be tailored to better meet the needs of your organization. In this lesson, you learn how to configure UAC so that it does not have to run on the Secure Desktop, how to require administrators to enter their credentials rather than just clicking OK, and to configure UAC so that administrators assisting standard users can access elevated privileges. After this lesson, you will be able to: n Configure local security policies related to UAC. n Configure behavior of the User Account Control elevation prompt. n Configure the behavior of Secure Desktop. Estimated lesson time: 40 minutes User Account Control (UAC) UAC is a security feature of Windows 7 that informs you when the action that you want to undertake requires an elevation of privileges. If you logged on with a user account that was a member of the local administrators group in previous versions of Microsoft Windows, such as Windows XP, you automatically had administrator-level access at all times. This, by itself, was not a problem because recommended good practice was that people logged on with accounts that were members of the local administrator group only when they needed to do something related to administration. The problem with this is that people tended to use their administrator account as their normal user account. It was convenient for them because they did not have to log off and log on again each time they wanted to do something related to systems administration. Unfortunately, this behavior presented a security problem because any program run by a user logged on with an administrative account runs with the rights and privileges of that user. UAC resolves this problem by allowing a user that is a member of the local Administrators group to run as a standard user most of the time and to briefly elevate their privileges so that they are running as administrators when they attempt to carry out specific administration-related tasks. To understand UAC, you need to understand the following concepts: n Privilege elevation All users of clients running Windows 7 run with the rights of a standard user. When a user attempts an act that requires administrative privileges, such as creating a new user account, her rights need to be raised from those of a standard user to those of an administrative user. This increase in rights is termed privilege elevation. UAC is a gateway to privilege elevation. It allows users who are members of the local Administrators group to access administrative rights, but ensures that the person accessing the Administrative rights is aware that they are doing so. 4 8 0 CHAPTER 9 Authentication and Account Control This privilege elevation occurs only for a specific task. Another task executed at the same time that also requires privilege elevation generates its own UAC prompt. n Admin Approval mode Admin Approval mode is where an administrator must give explicit approval for elevation to occur by responding to the UAC prompt. The UAC prompt might require either clicking yes, called prompting for consent, or entering a user name and password, which is called prompting for credentials. n Secure Desktop Secure Desktop ensures that malware is unable to alter the display of the UAC prompt as a method of tricking you into allowing administrative access. When you configure UAC to use the Secure Desktop, the desktop is unavailable when a UAC prompt is triggered. You must respond to the UAC prompt before you can interact with the computer. The dimmed screen is actually a screen shot of the current desktop, which is why if you have video running in the background and a UAC prompt uses Secure Desktop, the video appears to freeze. If you do not respond to a UAC prompt on a Secure Desktop after 150 seconds, Windows automatically denies the request for privilege elevation, and the computer returns to the standard desktop. UAC Settings You can determine how intrusive UAC is by configuring the User Account Control Settings dialog box, shown in Figure 9-1. You can access this dialog box from the User Accounts control panel by clicking the Change User Account Control Settings item. The dialog box consists of a slider that allows you to adjust UAC notifications between Always Notify and Never Notify. FIGURE 9-1 User Account Control Settings Lesson 1: Managing User Account Control CHAPTER 9 481 If you make an adjustment using this slider, you are prompted by UAC informing you that the program named UserAccountControlSettings is trying to make a change to your computer. You can see this dialog box in Figure 9-2. This dialog box is a security measure that ensures that malware is unable to modify your UAC settings without you being aware of it. If you see this message and you have not modified UAC yourself, it is likely that malware is attempting to compromise the integrity of your computer. FIGURE 9-2 UAC settings change warning The settings that you can configure using the slider do the following: n Always Notify This is the most secure setting. You are prompted before programs make changes to your computer or Windows settings that require administrator permissions. During notification, your desktop appears dimmed. This is because Secure Desktop has become active. You must respond to the UAC prompt before it is possible to do anything else with the computer. If you do not respond to the UAC prompt after 150 seconds, Windows automatically denies the request for privilege elevation, and the computer returns to the standard desktop. n Notify Me Only When Programs Try To Make Changes To My Computer When this option is set, you are prompted before programs make changes to your computer or Windows settings that require administrator permissions. Notification occurs on the Secure Desktop. If you do not respond to the UAC prompt after 150 seconds, Windows automatically denies the request for privilege elevation. n Notify Me Only When Programs Try To Make Changes To My Computer (Do Not Dim My Desktop) With this option, you are prompted before programs make changes that require administrator permissions. You are not prompted if you try to make changes to Windows settings that require administrator permissions using programs that are included with Windows. You are prompted if a program that is not included with Windows attempts to modify Windows settings. n Never Notify When logged on as an administrator, you are not notified before programs make changes to your computer or to Windows settings. If you are logged on as a standard user, any changes that require administrative privileges are automatically denied. 4 8 2 CHAPTER 9 Authentication and Account Control Quick Check n What is the difference between the Always Notify Me And Dim My Desktop Until I Respond and Always Notify Me UAC settings? Quick Check Answer n The Always Notify Me And Dim My Desktop Until I Respond setting uses Secure Desktop in conjunction with UAC. When the more secure option is in effect, you must respond to the UAC prompt before you can continue to use your computer. If the Always Notify Me setting is enabled, you can continue working without having to respond directly to the UAC prompt. User Account Control Policies You primarily manage UAC settings through Group Policy. The UAC policies are all located in the Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options node. There are 10 policies, all of which are prefixed by the name User Account Control, as shown in Figure 9-3. FIGURE 9-3 User Account Control policies In the next few sections, you learn more about these policies and how they influence the operation of User Account Control. UAC: Admin Approval Mode For The Built-In Administrator Account UAC: The Admin Approval Mode For The Built-In Administrator Account policy controls how Administrator Approval mode works for the built-in Administrator account. The built-in Administrator account is disabled by default, so this policy is relevant only if you have enabled . have done the following: n Installed Windows 7 on a stand-alone client PC named Canberra, as described in Chapter 1, “Install, Migrate, or Upgrade to Windows 7. ” real World Orin Thomas T he UAC. in this chapter: n Lesson 1: Managing User Account Control 479 n Lesson 2: Windows 7 Authentication and Authorization 493 4 7 8 CHAPTER 9 Authentication and Account Control Before You Begin To. this book. 4 7 4 CHAPTER 8 BranchCache and Resource Sharing Case Scenario 1: Permissions and Encryption A computer running Windows 7 Enterprise named Waverley has two NTFS-formatted volumes,