- Understanding Security Groups
- User Account Control: Smarter User Privileges
- Creating and Managing User Accounts
- Working with the User Accounts Dialog Box
- Working with the Local Users and Groups Snap-In
- Setting Account Policies
- Working with Users and Groups from the Command Line
- Creating and Enforcing Bulletproof Passwords
- Sharing Files with Other Users
- Using Parental Controls to Restrict Computer Usage
- Sharing Your Computer Securely
- From Here
This chapter is from the book
This chapter is from the book
This chapter is from the book
Setting Account Policies
Windows Vista Pro offers several sets of policies that affect user accounts. There are three kinds of account policies: security options, user rights, and account lockout policies. The next three sections take you through these policies.
Setting Account Security Policies
To see these policies, you have two choices:
- Open the Group Policy editor (press Windows Logo+R, type gpedit.msc, and click OK) and select Computer Configuration, Windows Settings, Security Settings, Local Policies, Security Options, as shown in Figure 6.7.
Figure 6.7 In the Security Options branch, use the five Accounts policies to configure security for your accounts.
- Launch the Local Security Settings snap-in (press Windows Logo+R, type secpol.msc, and click OK) and select Security Settings, Local Policies, Security Options.
)
The Accounts grouping has five policies:
- Administrator Account Status—Use this policy to enable or disable the Administrator account. This is useful if you think someone else might be logging on as the Administrator. (A less drastic solution would be to change the Administrator password or rename the Administrator account.)
- Guest Account Status—Use this option to enable or disable the Guest account.
-
Limit Local Account Use of Blank Passwords to Console Logon Only—When this option is enabled, Windows Vista allows users with blank passwords to log on to the system directly only by using the Welcome screen. Such users can't log on via either the RunAs command or remotely over a network. This policy modifies the following Registry setting:
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\limitblankpassworduse
- Rename Administrator Account—Use this option to change the name of the Administrator account.
- Rename Guest Account—Use this option to change the name of the Guest account.
Setting User Rights Policies
Windows Vista has a long list of policies associated with user rights. To view these policies, you have two choices:
- In the Group Policy editor, select Computer Configuration, Windows Settings, Security Settings, Local Policies, User Rights Assignment, as shown in Figure 6.8.
Figure 6.8 In the User Rights Assignment branch, use the policies to configure the rights assigned to users or groups.
- In the Local Security Policy snap-in, select Security Settings, Local Policies, User Rights Assignment.
)
Each policy is a specific task or action, such as Back Up Files and Directories, Deny Logon Locally, and Shut Down the System. For each task or action, the Security Setting column shows the users and groups who can perform the task or to whom the action applies. To change the setting, double-click the policy. Click Add User or Group to add an object to the policy; or delete an object from the policy by selecting it and clicking Remove.
Setting Account Lockout Policies
Last of all, Windows Vista has a few policies that determine when an account gets locked out, which means the user is unable to log on. A lock out occurs when the user fails to log on after a specified number of attempts. This is a good security feature because it prevents an unauthorized user from trying a number of different passwords. Use either of the following methods to view these policies:
- In the Group Policy editor, select Computer Configuration, Windows Settings, Security Settings, Account Policies, Account Lockout Policy, as shown in Figure 6.9.
Figure 6.9 In the Account Lockout Policy branch, use the policies to configure when an account gets locked out of the system.
- In the Local Security Policy snap-in, select Security Settings, Account Policies, Account Lockout Policy.
)
There are three policies:
- Account Lockout Duration—This policy sets the amount of time, in minutes, that the user is locked out. Note that, to change this policy, you must set the Account Lockout Threshold (described next) to a nonzero number.
- Account Lockout Threshold—This policy sets the maximum number of logons the user can attempt before being locked out. Note that after you change this to a nonzero value, Windows Vista offers to set the other two policies to 30 minutes.
- Reset Account Lockout Counter After—This policy sets the amount of time, in minutes, after which the counter that tracks the number of invalid logons is reset to 0.