Setting User Properties

After you create a user account, you can set additional properties for the user by right-clicking the new user and choosing Properties. This action brings up the User Properties dialog box, which has about a million tabs that you can use to set various properties for the user. Figure 16-5 shows the General tab, which lists basic information about the user, such as the user's name, office location, and phone number.

Figure 16-5: The General tab.

The following sections describe some of the administrative tasks that you can perform by using the tabs in the User Properties dialog box.

Changing a user's contact information

Several tabs in the User Properties dialog box contain contact information for the user:

• Address tab: Change the user's street address, post office box, city, state, zip code, and so on.

• Telephones tab: Specify the user's phone numbers.

• Organization tab: Record the user's job title and the name of his or her boss.

Setting account options

The Account tab of the User Properties dialog box, as shown in Figure 16-6, features a variety of interesting options that you can set for the user. From this dialog box, you can change the user's logon name. In addition, you can change the password options that you set when you created the account and set an expiration date for the account.

Figure 16-6: The Account tab.

The following account options are in the Account Options list box:

• User must change password at next logon: Use this option, which is selected by default, to create a one-time-only password that can get the user started with the network. The first time the user logs on to the network, he is asked to change the password.

• User cannot change password: Use this option if you don't want to allow users to change their passwords. (Obviously, you can't use this option and the previous one at the same time.)

• Password never expires: Use this option if you want to bypass the password expiration policy for this user so that he never has to change his password.

• Store password using reversible encryption: This option stores passwords by using an encryption scheme that hackers can easily break, so avoid it like the plague.

• Account is disabled: Use this option to create an account that you don't yet need. As long as the account remains disabled, the user cannot log on.

  Tip 

  See the section, "Disabling and Enabling User Accounts," later in this chapter, to find out how to enable a disabled account.

• Smart card is required for interactive logon: If the user's computer has a smart card reader to automatically read security cards, check this option to require the user to use it.

• Account is trusted for delegation: This option indicates that the account is trustworthy and can set up delegations.

  TECHNICAL STUFF 

  This feature is usually reserved for Administrator accounts.

• Account is sensitive and cannot be delegated: Prevent other users from impersonating this account.

• Use DES encryption types for this account: Beef up the encryption for applications that require extra security.

• Do not require Kerberos preauthentication: Select this option if you use a different implementation of the Kerberos protocol.

Setting a user's profile information

The Profile tab, as shown in Figure 16-7, lets you configure the user's profile information. This dialog box lets you configure three bits of information related to the user's profile:

• Profile path: Specifies the location of the user's roaming profile.

  For more information, see Chapter 22.

• Logon script: The name of the user's logon script. A logon script is a batch file that's run whenever the user logs on. The main purpose of the logon script is to map the network shares that the user requires access to.

  TECHNICAL STUFF 

  Logon scripts are a carryover from the early versions of Windows NT Server. In Windows Server 2003, a profile is the preferred way to configure the user's computer when she logs on, including setting up network shares. However, many administrators still like the simplicity of logon scripts. For more information, see the section, "Creating a Logon Script," later in this chapter.

• Home folder: Where you specify the default storage location for the user. Follow these steps:

  1. Set up a network share on a file server.

     Typically, this share is named Home.

  2. Assign a drive letter (usually H) that points to this location and specifies the variable %USERNAME%, like this:

      \\fileserver01\Home\%USERNAME% 

  Windows substitutes the user's actual username to determine the folder where the user's files are stored. For example, if the user's username is bcleaver, the user's home folder is \\fileserver01\Home\ bcleaver.

Figure 16-7: The Profile tab.

Tip 

The Profile tab lets you specify the location of an existing profile for the user, but it doesn't let you set up the profile. For more information about setting up a profile, see Chapter 22.