- New Features of EFS
- Don't Shoot Yourself in the Foot
- If You Forget, You Will Regret
- Changing Passwords Over RAS Connections
- Two Places To Manage User Accounts in Windows XP
- Password Reset Disk Dilemma
- Planning an EFS Strategy
- Conclusion
Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
Two Places To Manage User Accounts in Windows XP
In a workgroup environment or Fast User Switching mode, there are two places where you can manage user accounts in Windows XP: Computer Management and User Accounts in Control Panel. If you're not very familiar with the subtle differences between the two interfaces, you could be in for a surprise. First let's look at the user-account creation; then we'll talk about the password, which ties back to the encryption issue.
When you log on as administrator and create a new user account in Computer Management, by default the account is a Limited account. A Limited account acts like a guest account and doesn't have all the privileges needed to install new software. During the creation of the account, you have the opportunity to enter a password.
When you create a new account in User Accounts in the Control Panel, by default the account is a Limited account but the password is set to blank. You must set a password manually. Obviously, creating accounts with blank passwords is a bad idea.
TIP
Unlike Computer Management, the User Accounts window doesn't have a refresh option. If you want to refresh the screen, you must exit User Accounts and then go back.
This is where things get a bit tricky. If you know a user's password and want to change it, you should start at User Accounts. You must provide the existing password and then enter the new password. Users can also change their own passwords, as long as they remember the existing password. If a user forgets his password, you must go to Computer Management and reset it. User Accounts cannot be used to reset a forgotten password. The problem is that if you reset the password the user can end up losing all the encrypted data. Unless, of course, a DRA is configured (by default there's none), or you've backed up the user's certificate and private key. The third option is to use a password reset disk, which is discussed in the next section.
Windows XP SP2 enhances security and makes changes to some of the account management tasks, but since SP2 was not released at the time this article was written, its behavior won't be covered here.