Chapter 3: Securing User Accounts and Passwords

Part II

Securing Active Directory

Chapter 3

Securing User Accounts and Passwords

The account is the central unit of security on Microsoft Windows NT, Windows 2000, and Windows XP computers and the applications that run on them. Rights and permissions are assigned to accounts and checked by a resource such as a file or a folder at the time of access. It is important to understand that a user and a user account are different entities. Anyone who possesses the credentials associated with a user account can use that account, despite the name on it. A computer can secure and audit access to resources based on user accounts only, not on the identity of the person using the account.

For example, you might be asked to restrict access to a certain file to your organization s payroll managers, while in reality, you are restricting access to the file to the user account that the payroll managers use. Thus, you must protect the credentials used to validate that the person attempting to use the account is the person the account was issued to. By default, the credentials needed to use an account are the account name and password.