Microsoft Active Directory

Page 1

A user account is an AD DS (Active Directory Domain Service) object that contains all the information that's required to authenticate and authorize the user during the sign‑in process and build the user's access token.

With a user account, you can:

Allow or deny users permission to sign in to a computer based on their user account identity.

Grant users access to processes and services for a specific security context.

Manage users’ access to resources such as properties, shared folders, files, directories, and printer queues.

User accounts are also referred to as security principals. Security principals are directory objects that are automatically assigned security identifiers (SIDs), which can be used to access domain resources.

The Users container in Active Directory Users and Computers displays the three built-in user accounts: Administrator, Guest, and HelpAssistant. These built-in user accounts are created automatically when you create the domain.

Administrator - The Administrator account is a default member of the following Active Directory groups: Administrators, Domain Admins, Enterprise Admins, Group Policy Creator Owners, and Schema Admins. The Administrator account can never be deleted or removed from the Administrators group, but it can be renamed or disabled. Because the Administrator account is known to exist on many versions of Windows, renaming or disabling this account will make it more difficult for malicious users to try to gain access to it.

The Administrator account is the first account that is created when you set up a new domain with the Active Directory Domain Services Installation Wizard. When the Administrator account is disabled, it can still be used to gain access to a domain controller with Safe Mode.

Guest - People who do not have an actual account in the domain can use the Guest account. A user whose account is disabled (but not deleted) can also use the Guest account. The Guest account does not require a password. The Guest account is disabled by default, and we recommend that it stay disabled.

HelpAssistant - The primary account for establishing a Remote Assistance session. This account is created automatically when you request a Remote Assistance session. It has limited access to the computer. The HelpAssistant account is managed by the Remote Desktop Help Session Manager service. This account is automatically deleted if no Remote Assistance requests are pending.

If built-in account rights and permissions are not modified or disabled by a network administrator, they can be used by a malicious user (or service) to illegally log on to a domain using the Administrator account or Guest account. A good security practice for protecting these accounts is to rename or disable them. Because it retains its SID, a renamed user account retains all its other properties, such as its description, password, group memberships, user profile, account information, and any assigned permissions and user rights.

User object "account" attributes -

Log on hours (logonHours). This property defines when the account can be used to access domain computers. You can use the weekly calendar style view to define Logon permitted hours and Logon denied hours. For example, you could limit contractor or temporary personnel to certain office hours.

Log on to (logonWorkstation). Use this property to define which computers a user can use to log on to the domain. Specify the computer’s name and add it to a list of allowed computers. For example, you could restrict access to a specific workstation in a department area.

Account expires (End of). This setting is useful when you want to create temporary user accounts. For example, you might want to create user accounts for interns who will be at your company for just one year. You can set the account expiration date in advance.

Password Expires (Never). If you set this value, you must remember to periodically update the password. However, you aren't forced to do this at a predetermined interval. Therefore, the account can never be locked out because of password expiration—a feature that's specifically important for service accounts.

User Account templates - User templates allow administrators to create a default user account and use that account to create all the other users that match it. User templates can save you a lot of time and resources especially if you need to create a large number of users or fill out many of the same attribute fields repeatedly.

For example, a user account template named _LondonSales could be used to create all the other sales accounts in the London office. Information such as group memberships, home directory paths, profile paths, logon scripts, password settings, department, and manager can all be automatically filled in.

Keep in mind that not all information gets copied from a template. For example, Name, Logon Name, Password, Email, and Phone Number do not get copied. Best practices include disabling the template account so that it cannot be used to sign in and putting an underscore at the beginning of the name so that the template account is always at the top of the user list and easy to locate.

Fine-grained Password Policies. Let you specify different password policies and account lockout policies for different groups of users. For example, executives, administrators, service accounts, or regular users.