mspress 70 270 winxp professiona phần 4 pot

7-48 Chapter 7 Setting Up and Managing User Accounts 1. Martin’s user account was assigned permissions to access a number of resources on the computer and Raymond is not sure exactly what permissions were assigned. He wants to recover the deleted user account. Can he do this? If so, how? 2. If you really mean to delete the user account, what is often a better way to handle the situation than simply deleting the user account? 3. To prevent a situation like the one that happened with Raymond (in which rights and permissions to resources were assigned directly to Martin’s user account and were thus difficult to reconstruct), what is a better way to assign rights and permissions? 4. Soon after creating a new user account for Martin, Raymond contacts you and tells you that Martin has forgotten his new password. Can you reset his password? How? 5. What should you tell Martin to do so that he can recover his own password should this happen again? 7-49 Chapter Summary ■ Local user accounts allow users to log on at and access resources on only the com- puter on which you create the local user account. Domain user accounts allow users to log on to the domain and access resources anywhere on the network. ■ Local user account names must be unique on the computer on which you create the account, and domain user accounts must be unique to the directory. Pass- words can be up to 128 characters long; a minimum of 8 characters is recom- mended. Use a mixture of uppercase and lowercase letters, numerals, and valid nonalphanumeric characters in creating passwords. ■ You can administer local user accounts using the following two tools: ❑ The User Accounts tool allows administrators to create a new user account, change an existing account, and change the way a user logs on or logs off. ❑ The Computer Management snap-in allows you to create, modify, and delete user accounts for the local computer on which you are working. If your com- puter is part of a network, you can use the Computer Management snap-in on a remote computer. ■ After creating a user account, you can modify the properties for the account by using the Properties dialog box for the user account in Computer Management. ■ Groups simplify administration by allowing you to assign permissions and rights to a group of users rather than to individual user accounts. Windows XP Profes- sional creates local groups in the local security database, so you can use local groups only on the computer on which you create them. Exam Highlights Before taking the exam, review the key points and terms that are presented in this chapter. You need to know this information. Key Points ■ A domain does not recognize local user accounts, so do not create local user accounts on computers running Windows XP Professional that are part of a domain. Doing so restricts users from accessing resources in the domain and pre- vents the domain administrator from administering the local user account proper- ties or assigning access permissions for domain resources. ■ Allow Guest access only in low-security workgroups, and always assign a pass- word to the Guest account. You can rename the Guest account, but you cannot delete it. Exam Highlights 7-50 Chapter 7 Setting Up and Managing User Accounts ■ You should understand the guidelines for creating strong passwords. In particular, remember that a password should be a minimum of eight characters and should include a mix of uppercase and lowercase letters, numbers, and symbols. ■ After you delete a user account, there is no way to recover the rights and permis- sions associated with that user account. A better practice than deleting user accounts is to disable them until you are sure they are no longer needed. Key Terms Computer Management A console that provides access to a number of manage- ment utilities for administering a computer, including the ability to create, manage, and monitor shared folders. domain user account An account that allows you to log on to a domain to access network resources. group A collection of user accounts. Groups simplify administration by allowing you to assign permissions and rights to a group of users rather than to each user account individually. local security database A database on a computer running Windows XP Profes- sional that holds local user accounts and groups. local user account An account that allows you to log on to a specific computer to access resources on that computer. naming convention An organization’s established standard for identifying users. password reset disk A floppy disk that contains encrypted password information and allows users to change their password without knowing the old password. Permissions Permissions control what users can do with a resource such as a folder, a file, or a printer. Rights Rights allow users to perform system tasks, such as changing the time on a computer and backing up or restoring files. user profile A collection of folders and data that stores your current desktop envi- ronment, application settings, and personal data. 7-51 Questions and Answers Lesson 1 Review Page 7-7 1. Where do local user accounts allow users to log on and gain access to resources? Only on the computer on which the local user account is created. 2. Where should you create user accounts for computers running Windows XP Pro- fessional that are part of a domain? You should create it on one of the domain controllers. You should not use local user accounts on Windows XP Professional computers that are part of a domain. 3. Which of the following statements about domain user accounts are correct? (Choose all that apply.) a. Domain user accounts allow users to log on to the domain and gain access to resources anywhere on the network, as long as the users have the required access permissions. b. If at least one computer on the network is configured as a domain controller, you should use domain user accounts only. c. The domain controller replicates the new user account information to all other computers in the domain. d. A new domain user account is established in the local security database on the domain controller on which you created the account. The correct answers are A and B. C is not correct because the domain controller replicates user account information only to other domain controllers in a domain—not to every computer. D is not correct because a domain user account is established in Active Directory, not in the local security database. A local user account is established in the local security database. 4. Which of the following statements about built-in accounts are correct? (Choose all that apply.) a. You can delete the Guest account. b. You cannot delete the Administrator account. c. You cannot rename the Guest account. d. You can rename the Administrator account. The correct answers are B and D. A is not correct because you cannot delete the Guest account (or any built-in local user accounts, for that matter). C is not correct because you can rename the Guest account. Questions and Answers 7-52 Chapter 7 Setting Up and Managing User Accounts 5. How do you disable the Guest account? Click Start, click Control Panel, and then click User Accounts. In the User Accounts window, click the Guest icon. In the What Do You Want To Change About The Guest Account window, click Turn Off The Guest Account. The Guest Account is now disabled. Lesson 2 Review Page 7-12 1. The maximum number of characters that Windows XP Professional recognizes in a local user account name is __________. 20 2. When are duplicate local user accounts valid in a network of computers running Windows XP Professional? They are valid as long as they are not on the same computer. In fact, in a workgroup, you must create the same user account on each computer in the workgroup that you want the user to be able to access. 3. Passwords can be up to ______ characters long with a minimum length of ______ characters recommended. 128, 8 Page 7-22 Lesson 3 Practice: Exercise 2 6. What two new options appear for User1’s account? What option is no longer avail- able? The list of changes you can make to the user’s account includes two new options: Change The Password and Remove The Password. The Create A Password option is gone. Lesson 3 Practice: Exercise 4 Page 7-23 1. What type of account is User3? (Get answer.) The account type for User3 is Limited Account. 15. How does the password appear on the screen? Why? The password is displayed as large dots as you type. This prevents others from viewing the password as you type it. 23. What happens? A Logon Message dialog box appears, informing you that you are required to change your pass- word at first logon. Lesson 3 Review Page 7-26 1. Which of the following statements about the Windows XP Professional User Accounts tool are correct? (Choose all that apply.) 7-53 a. The User Accounts tool allows you to remotely create, modify, and delete user accounts on all computers in the network running Windows XP Profes- sional. b. The User Accounts tool allows you to view and modify all accounts on the computer. c. The tasks you can perform with the User Accounts tool depend on the type of account you use to log on to the local computer. d. The User Accounts tool allows users to delete, create, or remove their individ- ual passwords. The correct answers are C and D. A is not correct because you cannot use the User Accounts tool to administer a remote computer. B is not correct because the User Accounts tool does not allow you to administer certain built-in accounts. 2. Which of the following tasks can both account types (Computer Administrator and Limited) perform? (Choose all that apply.) a. Change your picture b. Change your account type c. Create, change, or remove your password d. Change your account name The correct answers are A and C. B and D are not correct because only computer administra- tors can change the account type and account name. 3. Which of the following statements about logging on or logging off a computer running Windows XP Professional are true? (Choose all that apply.) a. When you use the Welcome screen to log on the local computer, you can quickly switch to another user account without logging off and closing all programs that you are running. b. The User Accounts tool allows you to disable a local user account to prevent users from using the disabled account to log on. c. When you use the Welcome screen to log on the local computer, you can log on using only one of the accounts displayed on the Welcome screen. d. The User Accounts tool allows you to replace the Welcome screen with a logon prompt that requires users to type their individual user names and passwords. The correct answers are A and D. B is not correct because the User Accounts tool allows you to disable the Guest account, but not to disable other user accounts. C is not correct because you can press C TRL+ALT+DELETE at the Welcome screen to access the traditional logon dialog box, which allows you to type in a user name. Questions and Answers 7-54 Chapter 7 Setting Up and Managing User Accounts 4. When you use the Computer Management snap-in to create a new user account, which check box do you select to prevent a new employee from using the new account until the employee starts working for the company? Account Disabled Lesson 4 Practice: Modifying User Account Properties Page 7-32 1. What happens? Why? A User Accounts dialog box appears with the message Windows Cannot Change The Password. This happens because you enabled the User Cannot Change Password option for User1. Lesson 4 Review Page 7-33 1. When can you select the Account Is Locked Out check box for a user and why? Never because the Account Is Locked Out check box is unavailable when the account is active and is not locked out of the system. The system locks out a user if the user exceeds the limit for the number of failed logon attempts. 2. Which of the following statements about local user account properties are correct? (Choose all that apply.) a. You can configure all of the default properties associated with each local user account using the User Accounts tool located in Control Panel. b. In Computer Management, the General tab in a user account’s Properties dia- log box allows you to disable the account. c. In Computer Management, the General tab in a user account’s Properties dia- log box allows you to select the Account Is Locked Out check box to prevent the user from logging on to the computer. d. You can use the Computer Management snap-in to configure all of the default properties associated with each local user account. The correct answers are B and D. A is not correct because the User Accounts tool only provides a limited subset of the available options for a user account. You must use the Computer Man- agement snap-in to access all options for a user account. C is not correct because you cannot select the Account Is Locked Out check box manually. This check box is selected automatically when an account is locked out. 3. Which of the following statements about user profiles are correct? (Choose all that apply.) a. A user profile is a collection of folders and data that stores the user’s current desktop environment, application settings, and personal data. b. A user profile contains all the network connections that are established when a user logs on to a computer. 7-55 c. Windows XP Professional creates a user profile when you create a new local user account. d. You must create each user profile by copying and modifying an existing user profile. The correct answers are A and B. C is not correct because Windows XP does not create a user profile when you create a user account, but rather the first time someone logs on using that user account. D is not correct because a user profile is created automatically the first time a person logs on with a user account. 4. Which of the following statements about user profiles are correct? (Choose all that apply.) a. Users should store their documents in home directories rather than in their My Documents folders. b. The Profile tab in the account-name Properties dialog box for a user account allows you to create a path for the user profile, logon script, and home folder. c. A user profile contains the My Documents folder, which provides a place for users to store personal files. d. When users change their desktop settings, the changes are reflected in their user profiles. The correct answers are B, C, and D. A is not correct because the My Documents folder is located within a user’s home directory automatically when a home directory is created. Users do not need to go looking for their home directory. 5. What three tasks must you perform to create a home folder on a network server? First, create and share a folder in which to store all home folders on a network server. Second, for the shared folder, remove the default Full Control permission from the Everyone group and assign Full Control to the Users group for users that will reside in this shared folder. Third, pro- vide the path to the user’s home folder in the shared home directory folder on the Profile tab of the Properties dialog box for the user account. Lesson 5 Review Page 7-44 1. What are groups, and why do you use them? A group is a collection of user accounts. A group simplifies administration by allowing you to assign permissions and rights to a group of users rather than to each individual user account. 2. An administrator or owner of a resource uses __________________ to control what users can do with a resource such as a folder, a file, or a printer. Permissions 3. You use local groups to assign permissions to resources residing ______________ ________________________________________. On the computer on which the local group is created Questions and Answers 7-56 Chapter 7 Setting Up and Managing User Accounts 4. Which of the following statements about deleting local groups are correct? (Choose all that apply.) a. Each group that you create has a unique identifier that cannot be reused. b. You can restore access to resources by re-creating the group. c. When you delete a group, you also remove the permissions and rights asso- ciated with it. d. Deleting a group deletes the user accounts that are members of the group. The correct answers are A and C. B is not correct because re-creating a group does not re-cre- ate the membership of that group or any of the rights or permissions associated with that group. D is not correct because deleting a group does not delete the user accounts that are members of the group. Deleting a group does remove any rights and permissions that were extended to the members of the group by virtue of their membership. 5. What is the difference between built-in system groups and built-in local groups found on computers running Windows XP Professional? Give at least two exam- ples of each type of group. Built-in local groups give rights to perform system tasks on a single computer, such as backing up and restoring files, changing the system time, and administering system resources. Some examples of built-in local groups are Administrators, Backup Operators, Guests, Power Users, Replicator, and Users. Built-in system groups do not have specific memberships that you can modify, but they can represent different users at different times, depending on how a user gains access to a computer or resource. You do not see system groups when you administer groups, but they are available for use when you assign rights and permissions to resources. Some examples of built-in system groups are Everyone, Authenticated Users, Creator Owner, Network, Interactive, Anonymous Logon, and Dialup. Case Scenario Exercise Page 7-46 1. Your first task is to create a naming convention for these workers. The museum management would like the user names to reflect that these are temporary work- ers, but not require too complicated a user name for the workers to type. Use the following table to create names for the workers. Full Name User Account Name Cat Francis David Jaffe Mary North Jeff Teper Bernhard Tham 7-57 There are a number of ways you could create these user names. One way would be to use the first initial and last name of each person to create the user name and then to prepend each user name with a T to indicate the workers’ temporary status. This could give you the following user names: ❑ T_cfrancis ❑ T_djaffe ❑ T_mnorth ❑ T_jteper ❑ T_btham 2. Where should you create these user names? You must create a local user name for each user on the user’s workstation. You must also cre- ate a local user name for each user on the file server so that you can assign permissions. 3. The file server in the workgroup contains a folder named Coal Research, to which each of the workers needs access. You would like to minimize the number of times you have to assign permissions to the Research folder. How would you do this? You should create a local group on the file server. You should name the group something simple like Coal Researchers and then add each of the workers’ user names to that group. You can then assign permissions to the group for the Coal Research folder rather than assigning per- missions to each user name. 4. When creating passwords for the users on their workstations, what must you ensure so that the users can access the file server? You must not create blank passwords for the users on their workstations. Although blank pass- words would allow the users to log on to their workstations and access local resources, the default security configuration on the file server is to enable the Accounts: Limit Local Account Use Of Blank Passwords To Console Logon Only security setting, which would prevent users with blank passwords from being able to access resources on the file server remotely. Troubleshooting Lab Page 7-47 1. Martin’s user account was assigned permissions to access a number of resources on the computer and Raymond is not sure exactly what permissions were assigned. He wants to recover the deleted user account. Can he do this? If so, how? After a user account is deleted, it cannot be recovered. All permissions and rights assigned to the user account are lost. Questions and Answers [...]... Properties dialog box displays the Select Users Or Groups dialog box (see Figure 8 -4) Use this dialog box to add users or groups so that you can assign them permissions for accessing a folder or file The options available in the Select Users Or Groups dialog box are described in Table 8 -4 F08us 04 Figure 8 -4 Table 8 -4 Use the Select Users or Groups dialog box to add additional users and groups Select... text document named USER81 in the Library folder 4 Log off Windows XP Professional 5 Log on as User82, and then start Windows Explorer 6 Expand the Public\Library folder 7 Attempt to perform the following tasks on the USER81 file: ❑ Open the file ❑ Modify the file ❑ Delete the file 8 Which tasks were you able to perform and why? 9 Log off Windows XP Professional Lesson 2 Assigning NTFS Permissions... Account Type User81 Limited User82 Limited User83 Limited User 84 Limited Create the following folders: ■ C:\Public ■ C:\Public\Library Exercise 2: Determining the Default NTFS Permissions for a Folder In this exercise, you determine the default NTFS permissions for the newly created Public folder located on a computer running Windows XP Professional in a workgroup environment 1 Log on with a user account... click Text Document to create the text document 4 Were you successful? Why or why not? 5 Attempt to perform the following tasks for the file that you just created: ❑ Open the file ❑ Modify the file ❑ Delete the file 6 Were you able to complete all of these tasks and why? 7 In the Public folder, re-create the text file named User81 8 Log off Windows XP Professional 8-18 Chapter 8 Securing Resources... (with User82 displayed in the Name text box), in the Allow column, click Full Control 14 Click OK to close the Permission Entry For Public dialog box 15 Click OK to close the Advanced Security Settings For Public dialog box 16 Click OK to close the Public Properties dialog box 17 Close Explorer and log off Windows XP Professional 8-20 Chapter 8 Securing Resources with NTFS Permissions Exercise 5: Testing... on as User82 2 Start Windows Explorer 3 Expand Local Disk (C:), and then expand the Public folder 4 Attempt to perform the following tasks on the USER81 text document: ❑ Modify the file ❑ Delete the file 5 Which tasks were you able to record and why? 6 Close Windows Explorer and then log off Windows XP Professional Exercise 6: Testing NTFS Permissions In this exercise, you create a file in a subfolder... Windows XP Professional 2 Which of the following NTFS folder permissions allow you to delete the folder? Choose the correct answer a Read b Read & Execute c Modify d Administer 3 Which of the NTFS file permissions should you assign to a file if you want to allow users to delete the file but do not want to allow users to take ownership of a file? Lesson 1 Introduction to NTFS Permissions 8-7 4 What is... FAT volume Write permission Permissions are lost F08us07 Figure 8-7 Copy files or folders between folders or volumes 8- 24 Chapter 8 Securing Resources with NTFS Permissions When you copy a file within a single NTFS volume or between NTFS volumes, note the following: ■ Windows XP Professional treats it as a new file As a new file, it takes on the permissions of the destination folder ■ You must have... permission Select the Deny check box to deny a permission Add Opens the Select Users Or Groups dialog box, which you use to select user accounts and groups to add to the Group Or User Names list (see Figure 8 -4) Remove Removes the selected user account or group and the associated permissions for the file or folder Advanced Opens the Advanced Security Settings dialog box for the selected folder so that you can... to files and folders ❑ Control access to files and folders by using permissions Why This Chapter Matters This chapter introduces you to NT file system (NTFS) folder and file permissions for Windows XP Professional You will learn how to assign NTFS folder and file permissions to user accounts and groups, and you will see how moving or copying files and folders affects NTFS file and folder permissions . Groups dialog box are described in Table 8 -4. F08us 04 Figure 8 -4 Use the Select Users or Groups dialog box to add additional users and groups. Table 8 -4 Select Users Or Groups Dialog Box Options Option. dialog box, which allows you to type in a user name. Questions and Answers 7- 54 Chapter 7 Setting Up and Managing User Accounts 4. When you use the Computer Management snap-in to create a new user account, which. folder on the Profile tab of the Properties dialog box for the user account. Lesson 5 Review Page 7 -44 1. What are groups, and why do you use them? A group is a collection of user accounts. A group