Windows Authentication and Authorization
271 Questions
1 Views

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

What is the primary function of authentication in computer security?

  • To prevent unauthorized access
  • To determine what users can do on the system
  • To prove an individual's identity (correct)
  • To assign passwords to user accounts

    • In a Windows domain, what is responsible for handling authentication?

  • Active Directory (AD) (correct)
  • Windows Defender
  • Windows Firewall
  • User Account Control (UAC)

    • What does authorization determine in a system?

  • The speed of the network
  • The type of antivirus software to use
  • The level of security required
  • What an individual can do in the system after authentication (correct)

    • Which of the following is advisable when creating user accounts?

    <p>Assigning a password to each account and allowing users to change them</p> Signup and view all the answers

    What is the role of Active Directory (AD) in a Windows domain?

    <p>To handle authentication of users</p> Signup and view all the answers

    Which of the following is a criterion for creating a strong password?

    <p>Use 16 or more characters</p> Signup and view all the answers

    Which of the following is NOT advisable when creating a strong password?

    <p>Using consecutive letters or numbers</p> Signup and view all the answers

    Which of these is a recommended element to include in a strong password?

    <p>At least one symbol</p> Signup and view all the answers

    Which practice should be avoided when creating a strong password?

    <p>Using adjacent keyboard keys</p> Signup and view all the answers

    What is one of the criteria for creating a strong password?

    <p>Combining letters, numbers, and symbols</p> Signup and view all the answers

    Which tool works in Active Directory (AD) on a Windows domain to control the privileges of computers and users?

    <p>Group Policy</p> Signup and view all the answers

    What is the primary function of the Local Security Policy (secpol.msc)?

    <p>To apply Windows security settings to the local computer</p> Signup and view all the answers

    Which tool contains a subset of policies in Local Group Policy that specifically apply to Windows security settings?

    <p>Local Security Policy</p> Signup and view all the answers

    Which editions of Windows provide access to Local Group Policy and Local Security Policy editors?

    <p>Business and Professional</p> Signup and view all the answers

    What is the main difference between Group Policy and Local Group Policy?

    <p>Group Policy works domain-wide in AD; Local Group Policy applies only to the local computer or user</p> Signup and view all the answers

    Which editor includes a broader set of policies for managing security and settings?

    <p>Local Group Policy editor</p> Signup and view all the answers

    What is the primary function of the Local Security Policy editor?

    <p>To edit a subset of policies available in the Local Group Policy editor</p> Signup and view all the answers

    In which scenario would you use the Local Security Policy editor instead of the Local Group Policy editor?

    <p>When modifying a limited set of security policies</p> Signup and view all the answers

    Which of the following is NOT a function of the Local Group Policy editor?

    <p>Handling Active Directory user accounts</p> Signup and view all the answers

    What does Figure 7-2 illustrate about the relationship between the Local Group Policy editor and the Local Security Policy editor?

    <p>The Local Security Policy editor contains a subset of policies from the Local Group Policy editor</p> Signup and view all the answers

    What is the purpose of the Credential Manager applet in Control Panel?

    <p>To manage user credentials</p> Signup and view all the answers

    Which of the following credentials can be managed using the Credential Manager?

    <p>Web credentials</p> Signup and view all the answers

    What can be edited or deleted in the Windows Credentials section of Credential Manager?

    <p>Windows user names, passwords, and digital certificates</p> Signup and view all the answers

    Which of the following actions can be performed with credentials for accessing websites using Credential Manager?

    <p>Edit user name and password</p> Signup and view all the answers

    Where can you find the Credential Manager applet in a Windows system?

    <p>Control Panel</p> Signup and view all the answers

    Which password is specifically required to change the BIOS/UEFI setup?

    <p>Supervisor password</p> Signup and view all the answers

    What is the primary function of the drive lock password in BIOS/UEFI firmware?

    <p>To control access to the hard drive</p> Signup and view all the answers

    Where is the drive lock password stored?

    <p>On the hard drive</p> Signup and view all the answers

    Which BIOS/UEFI password is required to use the system?

    <p>User password</p> Signup and view all the answers

    What happens to the drive lock password if the hard drive is removed?

    <p>It remains effective</p> Signup and view all the answers

    Which key can be pressed to open the Internet Explorer menu bar?

    <p>Alt</p> Signup and view all the answers

    What should you look for in the browser address box to confirm that HTTPS is being used?

    <p>A padlock icon and https</p> Signup and view all the answers

    Which tool can be used to disable Internet Explorer?

    <p>Program and Features, Turn Windows features on or off</p> Signup and view all the answers

    Which of the following can you try if you have a problem with Internet Explorer 11?

    <p>Installing Windows updates</p> Signup and view all the answers

    Which version of Internet Explorer comes with Windows 10/8/7?

    <p>Internet Explorer 11</p> Signup and view all the answers

    Which option in the Delete Browsing History settings allows you to keep cookies and temporary Internet files from your favorite websites?

    <p>Preserve Favorites website data</p> Signup and view all the answers

    What is stored in the Temporary Internet files and website files option?

    <p>Copies of webpages, images, and media for faster viewing</p> Signup and view all the answers

    Which setting should you delete if you want to clear the list of websites you have visited?

    <p>History</p> Signup and view all the answers

    What type of data is stored under the 'Form data' option?

    <p>Information typed into forms</p> Signup and view all the answers

    Which option specifically stores passwords to automatically fill in when signing into websites?

    <p>Passwords</p> Signup and view all the answers

    Tracking Protection in Internet Explorer helps to:

    <p>Reduce the risk of automatic sharing of visit details by some websites</p> Signup and view all the answers

    Which tab would you use to change the home page in Internet Explorer?

    <p>General tab</p> Signup and view all the answers

    Where can you block cookies that might invade your privacy?

    <p>Privacy tab</p> Signup and view all the answers

    Which tab is used for configuring proxy server settings in Internet Explorer?

    <p>Connections tab</p> Signup and view all the answers

    Add-ons in Internet Explorer are managed through which tab?

    <p>Programs tab</p> Signup and view all the answers

    If you need to access miscellaneous settings to control Internet Explorer, which tab would you use?

    <p>Advanced tab</p> Signup and view all the answers

    Which file system is required for using Windows Encrypted File System (EFS)?

    <p>NTFS</p> Signup and view all the answers

    How is the encryption status of files and folders visually represented in Windows Explorer?

    <p>Green text</p> Signup and view all the answers

    What happens to an encrypted file if it is moved to an unencrypted folder?

    <p>It remains encrypted</p> Signup and view all the answers

    Which editions of Windows support Windows Encrypted File System (EFS)?

    <p>Professional</p> Signup and view all the answers

    What are the steps to encrypt a file or folder using EFS?

    <p>Right-click it, open Properties, click General tab, check Encrypt in Advanced Attributes</p> Signup and view all the answers

    What component on the motherboard holds the BitLocker encryption key during computer authentication?

    <p>TPM</p> Signup and view all the answers

    Which method of BitLocker authentication requires a USB drive?

    <p>User authentication</p> Signup and view all the answers

    What is required during every startup in the Computer and User Authentication method?

    <p>A PIN or password</p> Signup and view all the answers

    What is BitLocker primarily designed to encrypt?

    <p>The entire Windows volume and other volumes on the drive</p> Signup and view all the answers

    What happens if a hard drive encrypted with BitLocker is stolen and the startup key is not available?

    <p>The data remains unreadable</p> Signup and view all the answers

    What is one of the risks associated with using BitLocker?

    <p>TPM failure</p> Signup and view all the answers

    What should you do to mitigate the risks when using BitLocker?

    <p>Store an extra copy of the startup key and/or password in a safe location</p> Signup and view all the answers

    Where do you enable the TPM chip to start BitLocker Drive Encryption?

    <p>BIOS/UEFI setup</p> Signup and view all the answers

    When is it advisable to use BitLocker?

    <p>When the benefit of encrypting data exceeds the risk of losing the BitLocker key</p> Signup and view all the answers

    What is the first step in starting BitLocker Drive Encryption?

    <p>Enabling the TPM chip in BIOS/UEFI setup</p> Signup and view all the answers

    What type of firewall is a router considered to be?

    <p>Hardware firewall</p> Signup and view all the answers

    Which type of firewall might a large corporation use?

    <p>Corporate firewall</p> Signup and view all the answers

    What is another name for a personal firewall?

    <p>Host firewall</p> Signup and view all the answers

    What is Windows Firewall?

    <p>A personal firewall</p> Signup and view all the answers

    What happens to Windows Firewall when you set up a new network connection?

    <p>It is automatically configured</p> Signup and view all the answers

    What is one method of managing shared resources?

    <p>Assigning permissions to user accounts</p> Signup and view all the answers

    In the context of folder and file management, what is assigned to control access?

    <p>User permissions</p> Signup and view all the answers

    What else, besides user accounts, can be assigned permissions to manage shared resources?

    <p>Folders, files, and printers</p> Signup and view all the answers

    Which of the following is a direct way to control access to shared folders?

    <p>Assigning permissions to folders, files, and printers</p> Signup and view all the answers

    Which process involves assigning specific rights to users for accessing shared resources?

    <p>Permission assignment</p> Signup and view all the answers

    What does the principle of least privilege entail?

    <p>Assigning computer users only the rights required to perform their job</p> Signup and view all the answers

    How can privileges be altered after a user account is created?

    <p>By changing the user groups the account belongs to</p> Signup and view all the answers

    Which tool can be used to create user accounts?

    <p>User Accounts applet in Control Panel</p> Signup and view all the answers

    Where else can user accounts be managed apart from the User Accounts applet in Control Panel?

    <p>Local Users and Groups utility in the Computer Management console</p> Signup and view all the answers

    When are rights or privileges for a user account first established?

    <p>When an account is created</p> Signup and view all the answers

    Which console is used to create a user account in Windows?

    <p>Computer Management console</p> Signup and view all the answers

    Which user account type in Windows has administrative privileges?

    <p>Administrator account</p> Signup and view all the answers

    What is the first step to create a user account using Computer Management console?

    <p>Open the Computer Management console</p> Signup and view all the answers

    Where do you right-click to add a new user in the Computer Management console?

    <p>Users</p> Signup and view all the answers

    What must be done after entering the information for a new user in the Computer Management console?

    <p>Click Create</p> Signup and view all the answers

    Which user group has limited privileges and gets a temporary profile that is deleted upon logoff?

    <p>Guests group</p> Signup and view all the answers

    Which user group is retained in Windows 10/8/7 primarily for backward compatibility?

    <p>Power Users group</p> Signup and view all the answers

    Which user group in older editions could install apps and perform limited administrator tasks?

    <p>Power Users group</p> Signup and view all the answers

    What is a characteristic of the Guests group in built-in user groups?

    <p>Given a temporary profile that is deleted when user logs off</p> Signup and view all the answers

    Which of the following describes the Power Users group?

    <p>Can read from and write to parts of the system and perform limited administrator tasks</p> Signup and view all the answers

    Which user group includes all user accounts except the Guest account?

    <p>Authenticated Users group</p> Signup and view all the answers

    What is the key advantage of using customized user groups?

    <p>Simplifies permission management for multiple users</p> Signup and view all the answers

    In which console can custom user groups be created in business editions of Windows?

    <p>Management Console</p> Signup and view all the answers

    Which group includes both the Authenticated Users group and the Guest account?

    <p>Everyone group</p> Signup and view all the answers

    Who do anonymous users refer to?

    <p>Users who have not been authenticated on a remote computer</p> Signup and view all the answers

    Which folder is recommended for placing data that all users can share?

    <p>C:\Users\Public</p> Signup and view all the answers

    What is the primary benefit of workgroup sharing?

    <p>Offers better security than a homegroup</p> Signup and view all the answers

    Where should private data for individual users be stored?

    <p>C:\Users folder for that user</p> Signup and view all the answers

    Who manages security if a computer belongs to a domain?

    <p>Network administrator</p> Signup and view all the answers

    Which practice offers the best security for shared data?

    <p>Creating a separate folder with assigned permissions</p> Signup and view all the answers

    Which type of permissions in Windows only apply to network users and not to local users?

    <p>Share permissions</p> Signup and view all the answers

    What types of permissions apply to both folders and individual files?

    <p>NTFS permissions</p> Signup and view all the answers

    Where can NTFS permissions be configured in Windows?

    <p>Security tab in the Properties box</p> Signup and view all the answers

    Which permissions apply to a folder and its contents but not to individual files?

    <p>Share permissions</p> Signup and view all the answers

    On what type of volume do NTFS permissions work?

    <p>NTFS volumes</p> Signup and view all the answers

    What happens to an object's permissions when it is moved to a different folder on the same volume?

    <p>The object retains its permissions from the original folder</p> Signup and view all the answers

    If an object is copied to a new folder, what permissions does it inherit?

    <p>Permissions from the destination folder</p> Signup and view all the answers

    How are conflicting NTFS permissions resolved?

    <p>The more liberal permission applies</p> Signup and view all the answers

    What describes inherited permissions?

    <p>Permissions that come from a parent object</p> Signup and view all the answers

    Which principle applies when both share and NTFS permissions are used?

    <p>The most restrictive permission applies</p> Signup and view all the answers

    What is the main purpose of using the gpresult command?

    <p>To pull a list of all the groups a user belongs to</p> Signup and view all the answers

    When troubleshooting Group Policy problems, which command can provide useful user group information?

    <p>gpresult</p> Signup and view all the answers

    Which command retrieves information on a user other than the one signed in?

    <p>gpresult /scope user /user username /r</p> Signup and view all the answers

    Which type of information does the gpresult command provide?

    <p>User group memberships</p> Signup and view all the answers

    What can the information retrieved by gpresult help troubleshoot?

    <p>User group issues</p> Signup and view all the answers

    What does the /r parameter in the gpresult command accomplish?

    <p>Requests a summary of the information</p> Signup and view all the answers

    What is the function of the \v switch when using the gpresult tool?

    <p>Requests verbose output</p> Signup and view all the answers

    Which command would you use to retrieve a summary of Group Policy results for a user named 'admin'?

    <p>gpresult /r /user admin</p> Signup and view all the answers

    Which parameter would be used with gpresult to avoid excessive detail in the output?

    <p>/r</p> Signup and view all the answers

    What is displayed in Figure 7-32?

    <p>Summary of gpresult information</p> Signup and view all the answers

    Which tab do you select in the Properties box to access Advanced Sharing?

    <p>Sharing</p> Signup and view all the answers

    What is the first action to perform when setting up share permissions for a folder?

    <p>Open the Properties box for the folder</p> Signup and view all the answers

    After selecting the user account or user group, which button must you click to proceed?

    <p>OK</p> Signup and view all the answers

    Which box appears after clicking Add in the Permissions settings?

    <p>Select Users or Groups</p> Signup and view all the answers

    What should you do to remove the Everyone group from the Permissions box?

    <p>Select it and click Remove</p> Signup and view all the answers

    Where can you find the option to use advanced permissions settings?

    <p>Security tab of a folder's Properties box</p> Signup and view all the answers

    What happens to the permissions of subfolders by default?

    <p>They inherit the permissions of the parent folder</p> Signup and view all the answers

    Which tab in the Advanced Security Settings box allows you to check effective permissions?

    <p>Effective Permissions</p> Signup and view all the answers

    Why would you use advanced permissions settings?

    <p>To gain further control over user or group permissions</p> Signup and view all the answers

    What should you do if you have problems accessing a shared resource?

    <p>Follow the troubleshooting steps outlined in the resource</p> Signup and view all the answers

    What is a benefit of using only one workgroup for managing shared folders and files?

    <p>Enhanced performance</p> Signup and view all the answers

    Who has full permissions over a folder?

    <p>The owner of the folder</p> Signup and view all the answers

    What is one key recommendation to ensure security for user accounts?

    <p>Require passwords for all user accounts</p> Signup and view all the answers

    What does taking ownership of a folder entail?

    <p>Allowing full permissions to the owner</p> Signup and view all the answers

    Which of the following is advised for easier access to shared folders and files?

    <p>Using a mapped network drive</p> Signup and view all the answers

    Which tab in the Advanced Security Settings window allows you to add or remove permissions for a folder or file?

    <p>Permissions</p> Signup and view all the answers

    What is the purpose of the 'Auditing' tab in the Advanced Security Settings window?

    <p>To track changes made to files or folders</p> Signup and view all the answers

    Which feature allows you to assign permissions to multiple child objects within a folder?

    <p>Inheritance</p> Signup and view all the answers

    Which action can be performed from the 'Owner' tab in the Advanced Security Settings window?

    <p>Changing the ownership of a file or folder</p> Signup and view all the answers

    Why might you use the 'Effective Access' tab in the Advanced Security Settings window?

    <p>To evaluate user access permissions based on current settings</p> Signup and view all the answers

    What is the main advantage of using Network File System (NFS) over traditional file systems?

    <p>It allows files on a network to be accessed as if they are on a local computer.</p> Signup and view all the answers

    What is mapping a drive in the context of a network share?

    <p>Making a network host appear as a local hard drive on another computer.</p> Signup and view all the answers

    What type of system is Network File System (NFS) categorized as?

    <p>Distributed file system</p> Signup and view all the answers

    Which of the following statements best describes a network share?

    <p>A versatile method of sharing storage space over a network.</p> Signup and view all the answers

    What is a key characteristic of the Network File System (NFS)?

    <p>It makes network-stored files accessible as local files.</p> Signup and view all the answers

    What is the first step to enable offline files using Sync Center?

    <p>Go to Control Panel and open Sync Center</p> Signup and view all the answers

    Which menu in File Explorer allows you to force a manual sync of files?

    <p>Home</p> Signup and view all the answers

    What should you do after right-clicking a shared folder to make it available offline?

    <p>Click Always available offline</p> Signup and view all the answers

    What must be done to complete enabling offline files?

    <p>Restart your computer</p> Signup and view all the answers

    Where do you find the option to enable offline files?

    <p>In the Control Panel under Sync Center</p> Signup and view all the answers

    What feature allows users to access certain network files even when disconnected from the network?

    <p>Always available offline</p> Signup and view all the answers

    Which context menu option would you select to configure a network share as an offline folder?

    <p>Always available offline</p> Signup and view all the answers

    Where is the option 'Always available offline' located when configuring a folder?

    <p>In the right-click context menu</p> Signup and view all the answers

    Which screenshot feature allows users to open previously saved states of a file?

    <p>Restore previous versions</p> Signup and view all the answers

    What is the main purpose of the 'Sync' option in the right-click menu for an offline folder?

    <p>To synchronize the offline folder with the network share</p> Signup and view all the answers

    Which option would you select to make a folder available when not connected to the network?

    <p>Always available offline</p> Signup and view all the answers

    Which menu option should be selected to begin working with a folder that is currently available only online?

    <p>Work offline</p> Signup and view all the answers

    When using Windows Sync Center, which option ensures that a folder's contents are automatically updated with the network share?

    <p>Sync</p> Signup and view all the answers

    Which action should be taken to temporarily stop updates to a network folder while offline?

    <p>Work offline</p> Signup and view all the answers

    What is one method to prevent users on the network from seeing a shared folder?

    <p>Add a $ to the end of the folder name</p> Signup and view all the answers

    Why might you disable File and Printer Sharing on a network?

    <p>To enhance confidentiality of shared data</p> Signup and view all the answers

    How can a user access a hidden shared folder on the network?

    <p>By entering the complete path to the folder including $</p> Signup and view all the answers

    Which of the following statements correctly describes a local share?

    <p>Files and folders on a computer shared using local user accounts</p> Signup and view all the answers

    Which of the following is NOT a method to protect confidential data on a network?

    <p>Enable guest user access</p> Signup and view all the answers

    What is the main purpose of appending a dollar sign ($) at the end of a share name?

    <p>To create a hidden network share</p> Signup and view all the answers

    Which of the following methods would allow access to a hidden share on a network?

    <p>Searching for its exact name</p> Signup and view all the answers

    What is the consequence of not knowing the exact name of a hidden share?

    <p>The share cannot be located or accessed</p> Signup and view all the answers

    Which character is used to hide administrative shares in a network?

    <p>$</p> Signup and view all the answers

    What is the key difference between normal shares and hidden shares on a network?

    <p>Hidden shares are only accessible with the exact name</p> Signup and view all the answers

    Which folder is shared by default for administrator accounts at the domain level?

    <p>%systemroot% folder</p> Signup and view all the answers

    Which of the following is NOT an example of an administrative share?

    <p>Documents folder</p> Signup and view all the answers

    What is a characteristic of administrative shares?

    <p>They are always hidden from regular users</p> Signup and view all the answers

    What does an administrative share allow an administrator to do?

    <p>Gain remote access to default shared folders and drives</p> Signup and view all the answers

    Which shared resource is identified by %systemroot%?

    <p>The operating system installation folder</p> Signup and view all the answers

    Which command can be used to access an administrative share on a Windows domain?

    <p>\server\share$</p> Signup and view all the answers

    What is indicated by a dollar sign ($) at the end of a shared folder name in Windows?

    <p>It is a hidden share</p> Signup and view all the answers

    In the context of Windows domains, what is typically required to access administrative shares?

    <p>Administrative privileges</p> Signup and view all the answers

    Why might an IT administrator use the path \ws14\admins?

    <p>To access a hidden share on a domain</p> Signup and view all the answers

    Which folder in Windows File Explorer can often have quick access shortcuts?

    <p>Quick access</p> Signup and view all the answers

    Which of the following is NOT one of the five groups of services in Active Directory (AD)?

    <p>AD Management Services (AD MS)</p> Signup and view all the answers

    What is the primary role of Active Directory (AD) in Windows domains?

    <p>To handle domain access and user/computer activities</p> Signup and view all the answers

    Which service is responsible for providing a more lightweight directory service within AD?

    <p>AD Lightweight Directory Services (AD LDS)</p> Signup and view all the answers

    Which Active Directory service handles digital certificates?

    <p>AD Certificate Services (AD CS)</p> Signup and view all the answers

    Which AD service can be used to manage single sign-on (SSO) capabilities?

    <p>AD Federation Services (AD FS)</p> Signup and view all the answers

    In Active Directory, what is a forest?

    <p>The top-level container that holds domains and organizational units</p> Signup and view all the answers

    What is the primary purpose of an organizational unit (OU) in Active Directory?

    <p>To simplify the assignment of privileges and management of resources</p> Signup and view all the answers

    Which component in Active Directory contains the policies used to assign privileges?

    <p>Group Policy Objects (GPOs)</p> Signup and view all the answers

    How are the domains organized within a forest in Active Directory?

    <p>Domains are organized into organizational units and sub-organizational units</p> Signup and view all the answers

    Which of the following best describes the top-down hierarchical structure of Active Directory?

    <p>Forest &gt; Domains &gt; Organizational units &gt; Users and computers</p> Signup and view all the answers

    What component represents individual locations within a domain in an Active Directory forest?

    <p>Site</p> Signup and view all the answers

    Which component in Active Directory establishes and manages trust relationships between forests?

    <p>AD Federation Services</p> Signup and view all the answers

    Where are users and computers represented in the Active Directory organizational structure?

    <p>User Groups</p> Signup and view all the answers

    What is the primary hierarchical level in an Active Directory organizational structure?

    <p>Forest</p> Signup and view all the answers

    What is depicted by a house-shaped icon within a site in the Active Directory organizational structure?

    <p>Organizational Unit</p> Signup and view all the answers

    How are distinct Active Directory forests represented graphically?

    <p>Triangles</p> Signup and view all the answers

    What scope does Group Policy specifically apply to in a domain?

    <p>Organizational Units</p> Signup and view all the answers

    Which of the following describes the role of NTFS and Share Permissions in a domain?

    <p>They control access to folders.</p> Signup and view all the answers

    Which entity in an Organizational Unit typically holds the user accounts?

    <p>User Groups</p> Signup and view all the answers

    How many users are typically included in the user groups in the explained diagram?

    <p>Two</p> Signup and view all the answers

    What is the primary function of Organizational Units within a domain?

    <p>To organize users and apply Group Policies</p> Signup and view all the answers

    Which of the following is NOT a method to access the domain controller?

    <p>Using a VPN connection</p> Signup and view all the answers

    What tools are mentioned for creating a new user in Active Directory?

    <p>Server Manager</p> Signup and view all the answers

    When sitting at the computer, which of the following can you use to access the domain controller?

    <p>Direct Interaction</p> Signup and view all the answers

    Which method involves using command-line tools to manage Active Directory?

    <p>AD Administrative Center and PowerShell</p> Signup and view all the answers

    What is a required tool to follow the steps to create a new user?

    <p>Server Manager</p> Signup and view all the answers

    What is a requirement for passwords to meet AD's complexity requirements?

    <p>Password must contain at least 8 characters including lowercase and uppercase letters, numbers, and symbols</p> Signup and view all the answers

    Which practice is NOT recommended when setting password options in AD?

    <p>Select 'Password never expires'</p> Signup and view all the answers

    For which scenario might the 'Account is disabled' option be appropriate?

    <p>When setting up an account well in advance of its usage</p> Signup and view all the answers

    Why should the option 'Password never expires' not be selected?

    <p>It poses a security risk</p> Signup and view all the answers

    Which statement about password complexity in AD is correct?

    <p>Passwords require a mix of at least 8 lowercase and uppercase letters, numbers, and symbols</p> Signup and view all the answers

    What is the first step to unlock a user account that has been locked due to too many failed sign-in attempts?

    <p>Locate the account and right-click it</p> Signup and view all the answers

    Where do you need to navigate to check the 'Unlock account' option when unlocking a locked account?

    <p>Account tab in the Properties box</p> Signup and view all the answers

    Which of the following actions can be performed from the Properties box of a user account?

    <p>Reset a forgotten password</p> Signup and view all the answers

    To reset a forgotten password or disable/delete an account, what is the initial step after locating the account?

    <p>Right-click the account</p> Signup and view all the answers

    What should you do after selecting 'Reset Password' to complete the process?

    <p>Note the options to disable and delete the account</p> Signup and view all the answers

    What is the pre-Windows 2000 user logon name for Lucas Williams?

    <p>HOMERUN\lucas_williams</p> Signup and view all the answers

    Which account option is NOT available when managing Lucas Williams' account?

    <p>Password must have a minimum length</p> Signup and view all the answers

    Which option should be selected to require Lucas Williams to change his password the next time he logs in?

    <p>User must change password at next logon</p> Signup and view all the answers

    On which date does Lucas Williams' account expire if the 'End of' option is selected?

    <p>Tuesday, November 6, 2018</p> Signup and view all the answers

    What is indicated by the 'Unlock account' option?

    <p>The account is currently locked</p> Signup and view all the answers

    Which of the following fields are required to reset a user's password in AD?

    <p>New password and Confirm password</p> Signup and view all the answers

    What action must a user take for a password change to take effect after it is reset?

    <p>Log off and then log on again</p> Signup and view all the answers

    Which checkbox needs to be selected to ensure a user changes their password at the next logon?

    <p>User must change password at next logon</p> Signup and view all the answers

    What is the default status of the 'Account Lockout Status' during a password reset?

    <p>Unlocked</p> Signup and view all the answers

    Which button should be clicked to confirm the password reset?

    <p>OK</p> Signup and view all the answers

    Which account should be disabled in Active Directory for security reasons?

    <p>Guest account</p> Signup and view all the answers

    What can be set to limit how long a session remains disconnected before it ends?

    <p>Timeout and screen lock</p> Signup and view all the answers

    How can Active Directory change the Home folder location for a user?

    <p>Via folder redirection</p> Signup and view all the answers

    Why is it important for an Administrator password to be strong?

    <p>To prevent unauthorized access</p> Signup and view all the answers

    Why might logon time restrictions be implemented?

    <p>To perform routine maintenance</p> Signup and view all the answers

    What is the primary use of Group Policy on a domain controller?

    <p>To create Group Policy Objects</p> Signup and view all the answers

    What component contains policies that apply to an Organizational Unit (OU)?

    <p>Group Policy Object</p> Signup and view all the answers

    Which task is beyond the scope of the mentioned book?

    <p>Using Group Policy to manage GPOs</p> Signup and view all the answers

    Which step should be followed to understand how to create and edit a GPO?

    <p>Follow the steps outlined in the text</p> Signup and view all the answers

    Is the process of using Group Policy to manage GPOs detailed in the book?

    <p>No, it is beyond the scope of the book</p> Signup and view all the answers

    What is the first step to create a new Group Policy Object for the Domain Users OU?

    <p>Navigate to the Domain Users folder within the Group Policy Management Console</p> Signup and view all the answers

    After navigating to the Domain Users folder, which action should be performed to start creating a new GPO?

    <p>Right-click the Domain Users OU and select New GPO</p> Signup and view all the answers

    Which name should be entered in the Name box when creating the new GPO?

    <p>GPO user startup</p> Signup and view all the answers

    What is the final action needed to create the new GPO after entering the name?

    <p>Click the OK button</p> Signup and view all the answers

    What does the acronym GPO stand for in the context of Group Policy Management?

    <p>Group Policy Object</p> Signup and view all the answers

    In what order are Group Policy Objects (GPOs) applied?

    <p>Local, Site, Domain, OU, Enforced</p> Signup and view all the answers

    Which type of policy is applied last in the Group Policy Object (GPO) application order?

    <p>Enforced</p> Signup and view all the answers

    Which level of Group Policy Object (GPO) is applied first?

    <p>Local</p> Signup and view all the answers

    What happens if there is a conflict between a Site policy and an OU policy?

    <p>The OU policy wins</p> Signup and view all the answers

    Which policy takes precedence if there is a conflict between a Domain policy and a Local policy?

    <p>Domain policy</p> Signup and view all the answers

    Which policy source ultimately determines the 'Final Applied Policy' when a policy is enforced at the OU level?

    <p>OU Policy</p> Signup and view all the answers

    In the conflict resolution of policies, which policy source gets overridden by a Domain policy?

    <p>Site</p> Signup and view all the answers

    If 'Policy C' is applied at the Site level, what is the 'Final Applied Policy' for Policy C?

    <p>Site</p> Signup and view all the answers

    What is the default final applied policy if no other policies (Site, Domain, OU) are specified or enforced?

    <p>Local</p> Signup and view all the answers

    How does an enforced OU policy affect the hierarchy of policy application?

    <p>It overrides both site and domain policies.</p> Signup and view all the answers

    Which command would you use to view the policies set for a computer or user in a drill-down window?

    <p>rsop.msc</p> Signup and view all the answers

    What is displayed when using the gpresult /v command?

    <p>The policies currently applied to the computer and user</p> Signup and view all the answers

    What initial action must be performed to view the Resultant Set of Policy (RSOP)?

    <p>Enter the rsop.msc command in a command prompt window</p> Signup and view all the answers

    When analyzing policies applied to a computer, which command provides a verbose output?

    <p>gpresult /v</p> Signup and view all the answers

    To find the detailed set policies resulting from Group Policy processing for a user, which of the following commands is appropriate?

    <p>rsop.msc</p> Signup and view all the answers

    What is the minimum password age policy setting in the Default Domain Policy?

    <p>1 day</p> Signup and view all the answers

    How many passwords are remembered by the 'Enforce password history' policy in the Default Domain Policy?

    <p>24 passwords</p> Signup and view all the answers

    Which setting is applied to the 'Store passwords using reversible encryption' policy in the Default Domain Policy?

    <p>Disabled</p> Signup and view all the answers

    What is the value for the 'Account lockout threshold' policy in the Default Domain Policy?

    <p>0 invalid logon attempts</p> Signup and view all the answers

    What is the password complexity requirement status in the Default Domain Policy?

    <p>Enabled</p> Signup and view all the answers

    Which tool is used to encrypt files and folders on an NTFS file system?

    <p>Encrypting File System (EFS)</p> Signup and view all the answers

    What does applying the principle of least privilege entail?

    <p>Providing users only with the privileges necessary to perform their tasks</p> Signup and view all the answers

    Which feature is responsible for encrypting an entire volume on a hard drive?

    <p>BitLocker Drive Encryption</p> Signup and view all the answers

    To manage many settings for Internet Explorer, which dialog box is used?

    <p>Internet Options</p> Signup and view all the answers

    What can be created to simplify the management of privileges for multiple user accounts?

    <p>Customized user groups</p> Signup and view all the answers

    What are the two ways to share files and folders on a network?

    <p>Workgroup sharing and domain controllers</p> Signup and view all the answers

    What is a mapped network drive used for?

    <p>Easier access to drives and folders on the network</p> Signup and view all the answers

    How does Active Directory (AD) organize resources?

    <p>Top-down hierarchical structure</p> Signup and view all the answers

    What is included in a forest in Active Directory (AD)?

    <p>A domain</p> Signup and view all the answers

    What do managing resources in Active Directory (AD) mainly revolve around?

    <p>OU, user groups, and NTFS and share permissions</p> Signup and view all the answers

    What is the term used when Active Directory changes the Home folder location to a share on the network?

    <p>Folder redirection</p> Signup and view all the answers

    What is the correct sequence in which group policies are applied?

    <p>Local, site, domain, OU, enforced</p> Signup and view all the answers

    Which policy takes precedence in cases of conflict?

    <p>The last policy applied</p> Signup and view all the answers

    Which of the following is NOT part of the group policy application sequence?

    <p>Server</p> Signup and view all the answers

    What does 'OU' stand for in the context of group policies?

    <p>Organizational Unit</p> Signup and view all the answers

    Study Notes

    Controlling Access to Computer Resources

    • Controlling access to computer resources involves two key processes: Authentication and Authorization.

    Authentication

    • Defines the process of verifying an individual's identity to ensure they are who they claim to be.
    • In a Windows domain, Active Directory (AD) is responsible for authentication.

    Authorization

    • Determines the actions an individual can perform within the system after successful authentication.

    Password Management

    • Each user account should be assigned a password for secure access.
    • It's recommended to give users the ability to change their own passwords.

    Creating Strong Passwords

    • A strong password should be resistant to being guessed by both humans and computer programs
    • Strong password criteria:
      • Must have at least 16 characters
      • Combination of:
        • Uppercase and lowercase letters
        • Numbers
        • Symbols
      • At least one symbol must be included
      • Avoid using:
        • Consecutive letters or numbers
        • Adjacent keyboard keys
        • Sign-in name
        • Words in any language
      • Do not reuse passwords across multiple systems

    Windows Authentication Tools

    • Three tools control user and computer privileges:
    • Group Policy: works in Active Directory (AD) on a Windows domain
    • Local Group Policy (gpedit.msc): applies only to local computer or user, contains a subset of Group Policy settings
    • Local Security Policy (secpol.msc): applies only to local computer's Windows security settings, contains a subset of Local Group Policy settings

    Availability of Local Policy Editors

    • Local Group Policy and Local Security Policy editors available with:
    • Business editions of Windows
    • Professional editions of Windows

    Windows Authentication Policy Management

    • Two windows are used to manage security policies and settings: Local Group Policy editor and Local Security Policy editor.
    • These windows have different available settings.
    • The Local Security Policy editor is used to edit a subset of policies available in the Local Group Policy editor.
    • The Local Group Policy editor has more comprehensive policy settings compared to the Local Security Policy editor.

    Managing User Credentials in Windows

    • To access Credential Manager, open the applet in Control Panel
    • Credential Manager allows management of: • Web credentials • Windows credentials
    • In Web Credentials, you can: • Edit user name and password to access websites • Delete website login credentials
    • In Windows Credentials, you can: • Edit Windows user names • Edit Windows passwords • Edit and delete digital certificates installed on the system

    BIOS/UEFI Passwords

    • BIOS/UEFI firmware on the motherboard offers three types of power-on passwords:

    Types of Power-on Passwords

    • Supervisor password: required to change BIOS/UEFI setup, providing an additional layer of security
    • User password: required to use the system or view BIOS/UEFI setup, restricting access to system and setup
    • Drive lock password: required to access the hard drive, adding an extra layer of security to data stored on the drive

    Securing Internet Explorer

    • Internet Explorer 11 is the default browser in current releases of Windows 10/8/7
    • Windows 10 features Microsoft Edge as a replacement browser for Internet Explorer

    Internet Explorer 11 Tips

    • To open the menu bar, press the Alt key or right-click a blank area in the title bar and check Menu bar in the shortcut menu
    • Verify HTTPS (HTTP Secure) by looking for https and a padlock icon in the browser address box
    • Troubleshooting IE 11 issues:
      • Install Windows updates
      • Apply a restore point
      • Refresh Windows 10/8
    • Internet Explorer can be disabled by using Program and Features, Turn Windows features on or off

    Deleting Browsing History

    • Preserve Favorites website data: Allows cookies and temporary Internet files to retain preferences and display faster for favorite websites.
    • Temporary Internet files and website files: Copies of webpages, images, and media saved for faster viewing.
    • Cookies and website data: Files or databases stored on your computer by websites to save history, preferences, or improve website performance.
    • Components of browsing history: Includes history, download history, form data, passwords, and tracking protection.
    • History: A list of websites you have visited.
    • Download History: A list of files you have downloaded.
    • Form data: Saved information that you have typed into forms.
    • Passwords: Stored passwords that are automatically filled in when you sign in to a website you have previously visited.
    • Tracking Protection, ActiveX Filtering, and Do Not Track: A list of websites excluded from tracking data, used to detect when sites might automatically be sharing details about your visit, and exceptions to Do Not Track requests.

    Internet Options Box

    • General tab: allows changing the home page or adding a secondary home page tab, and protects identity and surfing records
    • Security tab: enables setting a zone security level

    Configuring Privacy and Security

    • Privacy tab: blocks cookies that might invade privacy or steal identity

    Network and Proxy Settings

    • Connections tab: configures proxy server settings and creates a VPN connection

    Managing Add-ons

    • Programs tab: manages add-ons (also called plug-ins)

    Miscellaneous Settings

    • Advanced tab: contains various settings to control Internet Explorer

    File and Folder Encryption in Windows

    • Windows Encrypted File System (EFS) enables file and folder encryption
    • EFS is compatible with NTFS file system and business/professional editions of Windows
    • Encrypting a folder ensures all files created in or copied to the folder are automatically encrypted
    • Encrypted files remain encrypted even when moved to an unencrypted folder

    Encrypting a Folder or File

    • Right-click the folder or file and open its Properties box
    • Click Advanced on the General tab
    • Check Encrypt contents to secure data and click OK in the Advanced Attributes box

    Identifying Encrypted Files and Folders

    • Encrypted file and folder names are displayed in green by default in File Explorer or Windows Explorer

    BitLocker Drive Encryption

    • Encrypts the entire Windows volume and any other volume on the drive
    • Restricts access by requiring one or two encryption keys
    • Works in partnership with file and folder encryption

    Ways to Use BitLocker Encryption

    • Computer Authentication

      • Requires a Trusted Platform Module (TPM) chip on the motherboard
      • Stores the BitLocker encryption key (startup key) in the TPM
      • Prevents access to the hard drive if it's stolen without the startup key

    • User Authentication

      • Stores the startup key on a USB drive

    • Computer and User Authentication

      • Requires a PIN or password at every startup
      • Example of multifactor authentication (MFA)

    BitLocker Encryption Considerations

    • BitLocker provides great security, but it comes with two significant risks: TPM failure and losing all copies of the BitLocker startup key.
    • Use BitLocker only if the risks of data theft outweigh the risks of using the encryption.

    Protecting BitLocker Keys

    • Make extra copies of the startup key and/or password to mitigate the risk of losing access.
    • Keep the extra copies in a safe and secure location.

    Enabling BitLocker

    • Enable the TPM chip in the BIOS/UEFI setup to start using BitLocker.
    • Open the BitLocker Drive Encryption applet in Control Panel to access the encryption feature.

    Firewall Types and Functions

    • A router can serve as a hardware firewall
    • A corporate firewall is a software firewall installed on a computer between the Internet and the network, often used by large corporations
    • A personal firewall (also known as a host firewall) is software that protects an individual computer

    Windows Firewall Settings

    • Windows Firewall is a personal firewall that protects a computer
    • Windows Firewall is automatically configured when setting up a new network connection
    • Windows Firewall settings can be customized

    Managing User Credentials

    • The Credential Manager applet in Control Panel allows you to manage web credentials and Windows credentials.
    • You can edit or delete user names and passwords to access websites.
    • You can also edit and delete Windows user names, passwords, and digital certificates installed on the system.

    Using BIOS/UEFI Passwords to Authenticate Users

    • BIOS/UEFI firmware on the motherboard offers power-on passwords, including:
      • Supervisor password: required to change BIOS/UEFI setup.
      • User password: required to use the system or view BIOS/UEFI setup.
      • Drive lock password: required to access the hard drive, stored on the hard drive.

    Securing Internet Explorer

    • The Internet Options dialog box can be used to secure Internet Explorer.
    • Tips for using Internet Explorer 11:
      • Press the Alt key or right-click a blank area in the title bar to open the menu bar.
      • Look for https and a padlock icon in the browser address box when HTTPS is used.
      • Try installing Windows updates, applying a restore point, or refreshing Windows 10/8 if you have a problem with IE 11.

    Deleting Browsing History

    • Options for deleting browsing history in Internet Explorer:
      • Preserve Favorites website data: keeps cookies and temporary Internet files for favorite websites.
      • Temporary Internet files and website files: copies of webpages, images, and media saved for faster viewing.
      • Cookies and website data: files or databases stored on your computer by websites.
      • History: list of websites you have visited.
      • Download History: list of files you have downloaded.
      • Form data: saved information typed into forms.
      • Passwords: stored passwords automatically filled in when signing in to a website.
      • Tracking Protection, ActiveX Filtering, and Do Not Track: list of websites excluded from tracking data.

    File and Folder Encryption

    • Windows Encrypted File System (EFS) can be used to encrypt files and folders.
    • EFS only works with the NTFS file system and business/professional editions of Windows.
    • An encrypted file remains encrypted if moved to an unencrypted folder.
    • To encrypt a folder or file, right-click it, open its Properties box, and check Encrypt contents to secure data.

    BitLocker Encryption

    • BitLocker Drive Encryption encrypts the entire Windows volume and any other volume on the drive.
    • BitLocker works in partnership with file and folder encryption.
    • Three ways to use BitLocker Encryption:
      • Computer Authentication: uses a TPM chip on the motherboard to hold the BitLocker encryption key.
      • User Authentication: stores the startup key on a USB drive.
      • Computer and User Authentication: requires a PIN or password at every startup, an example of multifactor authentication.

    Windows Firewall Settings

    • A router can serve as a hardware firewall.
    • A personal firewall, such as Windows Firewall, protects a computer.
    • Windows Firewall is automatically configured when setting up a new network connection and can be customized.

    Controlling Access to Folders and Files

    • Managing shared resources is accomplished by:
      • Assigning permissions to user accounts.
      • Assigning permissions to folders, files, and printers.

    Using Windows to Authenticate Users

    • Controlling access to computer resources is done by:
      • Authentication: proves that an individual is who they say they are.
      • Authorization: determines what an individual can do in the system after authentication.
    • Create strong passwords by using 16 or more characters, combining uppercase and lowercase letters, numbers, and symbols, and avoiding common patterns.

    User Account Management

    • The principle of least privilege is an approach to assigning users the minimum rights required to perform their job tasks.
    • User rights or privileges are initially established during user account creation, which determines the account type.
    • Privileges can be modified later by changing the user groups associated with the account.
    • User accounts can be created using two methods:
      • Through the User Accounts applet in the Control Panel.
      • Through the Local Users and Groups utility in the Computer Management console.

    Classifying User Accounts

    • There are two main types of user accounts: Administrator account and Standard user account

    Creating a User Account using Computer Management

    • To create a user account, open the Computer Management console (compmgmt.msc)
    • To create a new user, right-click Users under Local Users and Groups and select New User in the shortcut menu
    • Enter required information for the new user and click Create to complete the process

    Built-in User Groups

    • There are three main built-in user groups in Windows: Administrators, Users, and Guests.
    • The Guests group has limited privileges and is assigned a temporary profile that is deleted when the user logs off.
    • The Power Users group is available in older editions of Windows and allows users to read from and write to parts of the system, install apps, and perform limited administrator tasks.
    • In Windows 10, 8, and 7, the Power Users group is only available for backward compatibility.

    Classifying User Accounts and User Groups

    Built-in User Groups

    • Windows automatically assigns built-in user groups to an account, including:
    • Authenticated Users group, which includes all user accounts except the Guest account
    • Everyone group, which includes the Authenticated Users group as well as the Guest account
    • Anonymous users are users who have not been authenticated on a remote computer

    Customized User Groups

    • Custom user groups can be created using:
    • Management Console
    • Local Users and Groups console in business and professional editions of Windows
    • Creating custom user groups makes it:
    • Easier to assign permissions to user groups rather than to individual accounts
    • Useful when several users need the same permissions

    Managing Shared Folders and Files in Windows

    • There are two general strategies for managing shared folders and files in Windows: Workgroup sharing and Domain Controlling
    • Workgroup sharing offers better security than a homegroup
    • Domain Controlling is used when a computer belongs to a domain, and all security is managed by the network administrator for the entire network

    Organizing Shared Data

    • Private data for individual users should be kept in the C:\Users folder for that user
    • Data for all users to share should be placed in the C:\Users\Public folder
    • For best security, create a folder outside of the above folders and assign permissions to that folder and its subfolders
    • This allows control over access, granting permissions to:
      • All users
      • Certain users or user groups

    Methods to Assign Permissions to Folders and Files

    Workgroup Sharing Methods

    • Windows offers two methods to share a folder using workgroup sharing

    Share Permissions

    • Grant permissions only to network users, not to local users
    • Apply to a folder and its contents, not to individual files

    NTFS Permissions

    • Apply to both local users and network users
    • Apply to both folders and individual files
    • Work only on NTFS volumes
    • Configured using the Security tab in a file or folder's Properties box

    Implementing Permissions

    • When both share and NTFS permissions are used, the most restrictive permission is applied.
    • When NTFS permissions conflict, the more liberal permission is applied.

    Permission Propagation

    • Permission propagation occurs when permissions are passed from parent to child.

    Inherited Permissions

    • Inherited permissions are permissions attained from a parent object.

    Moving and Copying Objects

    • When an object is moved or copied to a folder, it takes on the permissions of that folder.
    • Exception: When an object is moved (not copied) from one location to another on the same volume, it retains its original permissions from the original folder.

    gpresult Command

    • Use the gpresult command to retrieve a list of all groups a user belongs to
    • The command provides information helpful for troubleshooting user group issues and Group Policy problems
    • To retrieve information on a user other than the one signed in, use the command: gpresult /scope:user /username: /r

    Methods to Assign Permissions to Folders and Files

    • Two general strategies for managing shared folders and files in Windows: Workgroup sharing and Domain Controlling
    • Workgroup sharing offers better security than a homegroup
    • Domain Controlling is used when a computer belongs to a domain, and all security is managed by the network administrator for the entire network
    • Tips on which folder to use to hold shared data:
      • Private data for individual users is best kept in the C:\Users folder for that user
      • Data for all users to share should be placed in C:\Users\Public folder
      • For best security, create a folder not in either of the above folders and assign permissions to that folder and its subfolders
        • Allow all users access or only certain users or user groups

    Methods to Assign Permissions to Folders and Files (continued)

    • Using workgroup sharing, Windows offers two methods to share a folder:
      • Share permissions: grant permissions only to network users and not to local users
        • Apply to a folder and its contents, not to individual files
      • NTFS permissions: apply to local users and network users
        • Apply to both folders and individual files
        • Work on NTFS volumes only
        • Configured using the Security tab in a file or folder's Properties box

    Implementing Permissions

    • Tips when implementing permissions:
      • If both share and NTFS permission are used, the most restrictive permission applies
      • If NTFS permissions are conflicting, the more liberal permission applies
      • Permission propagation: when permissions are passed from parent to child
      • Inherited permissions: permissions attained from a parent object
      • When you move or copy an object to a folder, the object takes on permissions of that folder
        • Exception: when you move (not copy) an object from one location to another on the same volume, the object retains its permissions from the original folder

    Managing User Credentials

    • Manage User Credentials using the Credential Manager applet in Control Panel
      • Allows you to manage web credentials and Windows credentials
      • You can edit or delete the user name and password to access websites
      • When you click Windows Credentials:
        • You can edit and delete Windows user names, passwords, and digital certificates installed on the system

    BIOS/UEFI Passwords to Authenticate Users

    • BIOS/UEFI firmware on the motherboard offers power-on passwords:
      • Supervisor password: required to change BIOS/UEFI setup
      • User password: required to use the system or view BIOS/UEFI setup
      • Drive lock password: required to access the hard drive
        • Stored on the hard drive, so it will still control access to drive in the event the drive is removed

    Securing Internet Explorer

    • The Internet Options dialog box can be used to secure Internet Explorer
      • Tips about using Internet Explorer 11:
        • To open the Internet Explorer menu bar, press the Alt key or right-click a blank area in the title bar and check Menu bar in the shortcut menu
        • Look for https and a padlock icon in the browser address box when HTTPS (HTTP Secure) is used
        • If you have a problem with IE 11, try installing Windows updates, applying a restore point, or refreshing Windows 10/8
          • You can disable Internet Explorer by using Program and Features, Turn Windows features on or off

    Deleting Browsing History

    • Preserve Favorites website data: keep cookies and temporary Internet files that enable your favorite websites to retain preferences and display faster
    • Temporary Internet files and website files: copies of webpages, images, and media that are saved for faster viewing
    • Cookies and website data: files or databases stored on your computer by websites to save history, preferences, or improve your website performance
    • History: list of websites you have visited
    • Download History: list of files you have downloaded
    • Form data: saved information that you have typed into forms
    • Passwords: stored passwords that are automatically filled in when you sign in to a website you have previously visited
    • Tracking Protection, ActiveX Filtering, and Do Not Track: a list of websites excluded from tracking data used by tracking protection to detect when sites might automatically be sharing details about your visit, and exceptions to Do Not Track requests

    Important Tabs in the Internet Options Box

    • General tab: change the home page or add a second home page tab, protect your identity and surfing records
    • Security tab: set a zone security level
    • Privacy tab: block cookies that might invade your privacy or steal your identity
    • Connections tab: allows you to configure proxy server settings and create a VPN connection
    • Programs tab: used to manage add-ons (called plug-ins)
    • Advanced tab: contains several miscellaneous settings used to control Internet Explorer

    File and Folder Encryption

    • In Windows, files and folders can be encrypted using Windows Encrypted File System (EFS)
      • Works only with the NTFS file system and business/professional editions of Windows
      • If a folder is marked for encryption, every file created in or copied to the folder will be encrypted
      • An encrypted file remains encrypted if moved to an unencrypted folder
    • To encrypt a folder or file:
      • Right-click it and open its Properties box
      • On the General tab, click Advanced
      • In the Advanced Attributes box, check Encrypt contents to secure data and click OK

    BitLocker Encryption

    • BitLocker Drive Encryption encrypts the entire Windows volume and any other volume on the drive
      • Restricts access by requiring one or two encryption keys
      • Works in partnership with file and folder encryption
    • Three ways to use BitLocker Encryption:
      • Computer Authentication: uses a chip on the motherboard called TPM (Trusted Platform Module) to hold the BitLocker encryption key
      • User Authentication: uses a startup key stored on a USB drive
      • Computer and User Authentication: requires a PIN or password at every startup
        • An example of multifactor authentication (MFA)

    Windows Firewall Settings

    • A router can serve as a hardware firewall
    • In addition, a large corporation might use a software firewall (called corporate firewall) installed on a computer between Internet and the network
    • A personal firewall (also called host firewall) is software on a computer to protect that computer
    • Windows Firewall is a personal firewall that protects a computer
      • Automatically configured when you set up your security level for a new network connection
      • Can also customize the settings

    Controlling Access to Folders and Files

    • Managing shared resources is accomplished by:
      • Assigning permissions to user accounts
      • Assigning permissions to folders, files, and printers

    Classifying User Accounts and User Groups

    • Principle of least privilege: an approach where computer users are assigned the minimum rights required to do their job
    • Rights or privileges are established when you first create a user account (when you decide the account type)
    • Privileges can later be changed by changing the user groups to which the account belongs
    • User accounts are created using the User Accounts applet in Control Panel
      • Or by using the Local Users and Groups utility in the Computer Management console

    Type of User Account

    • Administrator account
    • Standard user account

    Built-in User Groups

    • Administrators and Users groups
    • Guests group
      • Has limited privileges and is given a temporary profile that is deleted when user logs off
    • Power Users group
      • Older editions offer this group that can read from and write to parts of the system, install apps, and perform limited administrator tasks
      • Windows 10/8/7 offers this group only for backward compatibility

    Windows Might Automatically Assign One of These Built-in User Groups to an Account

    • Authenticated Users group: includes all user accounts except the Guest account
    • Everyone group: includes the Authenticated Users group as well as the Guest account
    • Anonymous users: users who have not been authenticated on a remote computer

    Customized User Groups

    • Use Management Console or the Local Users and Groups console in business and professional editions of Windows to create custom user groups
    • Easier to assign permissions to user groups rather than to individual accounts
      • User groups work well when several users need the same permissions

    Sharing Folders and Files

    • For NTFS volumes, it is recommended to use NTFS permissions whenever possible.

    Using Share Permissions

    • To share a folder, follow these steps:
      • Open the folder's Properties box, select the Sharing tab, and click Advanced Sharing.
      • Check the "Share this folder" option and click Permissions.
      • Click Add to add a new user or group.
      • In the Select Users or Groups box, enter a user account or a user group and click OK.
      • To remove the Everyone group, select it in the Permissions box and click Remove.

    Managing Shared Folders and Files

    • Troubleshoot access issues by following the steps outlined in the text
    • Use advanced permissions settings to gain further control of a user or group
      • Access advanced permissions by clicking Advanced on the Security tab of a folder's Properties box

    Inheritance and Permissions

    • Subfolders inherit permissions of the parent folder
    • Manage permissions using the parent folder

    Effective Permissions

    • Check the Effective Permissions tab of the Advanced Security Settings box to determine the actual permissions in effect

    Sharing Folders and Files

    • Folder Ownership: The owner of a folder always has full permissions.
    • Workgroup Optimization: Using only one workgroup improves performance, as it ensures all users are in the same workgroup.
    • Password Security: Require passwords for all user accounts to maintain security.
    • Mapped Network Drive: Use a mapped network drive for convenient access and management of shared folders and files.

    Methods to Assign Permissions to Folders and Files

    • Two strategies for managing shared folders and files in Windows:
      • Workgroup sharing offers better security than a homegroup
      • Domain Controlling manages security for the entire network if the computer belongs to a domain
    • Tips for choosing a folder to hold shared data:
      • Private data: C:\Users folder for each user
      • Shared data: C:\Users\Public folder or a custom folder with assigned permissions

    Share Permissions

    • Two methods to share a folder using workgroup sharing:
      • Share permissions grant permissions only to network users, not local users
      • NTFS permissions apply to both local and network users, work on NTFS volumes only
    • Share permissions apply to folders and their contents, not individual files
    • NTFS permissions can be configured using the Security tab in a file or folder's Properties box

    Implementing Permissions

    • Important tips:
      • Most restrictive permission applies when both share and NTFS permissions are used
      • Inherited permissions: permissions attained from a parent object
      • Permission propagation: permissions passed from parent to child
      • When moving an object, it takes on permissions of the new folder, except when moving within the same volume

    Sharing Folders and Files

    • Tips for managing shared folders and files:
      • Take ownership of a folder (owner always has full permissions)
      • Use only one workgroup for better performance
      • Require passwords for all user accounts
      • Use a mapped network drive

    Authenticating Users

    • Manage User Credentials:
      • Use Credential Manager applet in Control Panel
      • Manage web credentials and Windows credentials
    • BIOS/UEFI firmware offers power-on passwords:
      • Supervisor password (required to change BIOS/UEFI setup)
      • User password (required to use the system or view BIOS/UEFI setup)
      • Drive lock password (required to access the hard drive)

    File and Folder Encryption

    • Windows Encrypted File System (EFS):
      • Works only with NTFS file system and business/professional editions of Windows
      • Encrypts files and folders to secure data
    • BitLocker Drive Encryption:
      • Encrypts entire Windows volume and any other volume on the drive
      • Restricts access by requiring one or two encryption keys

    Windows Firewall Settings

    • Windows Firewall:
      • A personal firewall that protects a computer
      • Automatically configured when setting up a new network connection
      • Can be customized for better security

    Controlling Access to Folders and Files

    • Managing shared resources:
      • Assigning permissions to user accounts
      • Assigning permissions to folders, files, and printers
    • Principle of least privilege: an approach where users are assigned minimum rights required to do their job

    Classifying User Accounts and User Groups

    • Types of user accounts:
      • Administrator account
      • Standard user account
    • Built-in user groups:
      • Administrators and Users groups
      • Guests group
      • Power Users group (older editions, for backward compatibility)
    • Customized user groups:
      • Use Management Console or Local Users and Groups console to create custom groups
      • Easier to assign permissions to user groups rather than individual accounts

    Network Shares

    • A network share allows a client computer to access hard drive space on another host computer as if it were a local hard drive
    • Mapping the drive makes the remote hard drive space appear as a new local drive (e.g. drive E)

    Network File System (NFS)

    • Enables access to files on the network as easily as if they were stored on the local computer
    • A type of distributed file system (DFS) that shares files on a network

    Sync Center

    • Sync Center enables synchronization of shared folders or volumes between two computers
    • Located in Control Panel as an applet

    Enabling Sync Center and Offline Files

    • To enable Sync Center and offline files, follow these steps:
      • Go to Control Panel, open Sync Center, and click Manage offline files
      • Click Enable offline files and then click OK (requires a computer restart)
      • Right-click a shared folder in File/Windows Explorer and select Always available offline
      • The folder will sync on both local and remote computers

    Manual Sync

    • To force a manual sync of files in a folder:
      • Open File Explorer, select the folder, and open the Home menu
      • Click Easy access and then click Sync

    Windows File Explorer

    • Windows File Explorer displays a list of drives and folders on the left, including local disks, network drives, and computer names.
    • The drives and folders listed include Local Disk (C), Local Disk (D), Netwerk, ANDRDAS, BMC-DESKTOP7777, LENOVOLAPTOP, and Camtasia.

    Folder Options

    • The Resources folder has a right-click menu with options, including:
      • Open and open in new window
      • Pin to Quick access and Pin to Start
      • Scan with Windows Defender and Map network drive
      • Always available offline (configure a network share as an offline folder)
      • Restore previous versions and Include in Library
      • Copy, Paste, Create shortcut, and Properties

    Sync Center and Offline Files

    • A Windows File Explorer folder is displayed, titled "LENDVOLAPTOP", containing various files and folders.
    • The folder contains files and folders such as Lamtosa, Data, Data2, dlme, Downloads, Financial, Resources, and Users.
    • A right-click menu is open, providing options:
      • Easy access
      • Include in library
      • Map as drive
      • Always available offline
      • Sync
      • Work offline

    Protecting Confidential Data

    • Disable File and Printer Sharing to prevent unauthorized access to confidential data on the network
    • Hide a shared folder by adding a $ to the end of the folder name to conceal it from other users

    Hidden Shared Folders

    • To access a hidden shared folder, users must enter the complete path to the folder, including the $, in the search box
    • Hidden shared folders are not visible to other users, but can still be accessed by those who know the complete path

    Local Shares

    • Local shares refer to folders and files on a computer that are shared with others using local user accounts

    Hidden Network Resources and Administrative Shares

    • A hidden share can be created by adding a dollar sign ($) at the end of the share name.
    • The hidden share will not be visible unless the exact name is used to locate it.
    • To access a hidden, shared folder on the network, you need to search for its exact name.

    Administrative Shares

    • Administrative shares are folders shared by default, accessible to administrator accounts at the domain level.
    • There are two types of administrative shares:

    Types of Administrative Shares

    • One type is the %systemroot% folder, which is a critical system directory.
    • The other type includes any volume or drive, providing broad access to administrator accounts.

    Accessing Administrative Shares

    • An administrative share can be accessed through a Windows File Explorer window.
    • The address bar in the File Explorer window is set to a specific format, in this case, "\ws14\admins".
    • This format is used to access the administrative share on a domain.
    • The File Explorer window displays various folders, including "Quick access", "Desktop", and "Downloads", when accessing the administrative share.

    Active Directory Overview

    • Active Directory (AD) is a suite of services and databases provided by Windows Server.
    • AD is used to manage Windows domains, including access to the domain and what users and computers can do in the domain.

    Active Directory Components

    • Active Directory incorporates five groups of services:
    • Active Directory Domain Services (AD DS)
    • Active Directory Certificate Services (AD CS)
    • Active Directory Federation Services (AD FS)
    • Active Directory Rights Management (AD RMS)
    • Active Directory Lightweight Directory Services (AD LDS)

    Active Directory Hierarchy

    • Active Directory organizes resources in a top-down hierarchical structure
    • The highest level of this hierarchy is the forest, which represents the entire enterprise

    Domains and Organizational Units

    • A forest contains one or more domains, which are organized into organizational units (OUs)
    • OUs are further divided into sub-organizational units

    Organizational Units (OUs)

    • OUs are created to simplify the assignment of privileges to users and computers within the OU
    • Privileges are assigned using policies created by Group Policy
    • These policies are contained in Group Policy Objects (GPOs)

    Active Directory Organizational Structure

    • An Active Directory organizational structure consists of multiple components, forming a hierarchical relationship between them.
    • A Forest is a collection of one or more domains, represented by blue triangles.
    • Trust Relationships between forests are managed by AD Federation Services, depicted by an arrow connecting the two forests.
    • A Domain is a part of a forest, containing Sites, represented by a blue triangle with two circles labeled "Site".
    • Sites are individual circular shapes within a domain.
    • An Organizational Unit (OU) is represented by a house-shaped icon within a site.
    • User Groups are two boxes inside the OU, containing users and computers.
    • Users and Computers are represented by icons inside the user groups.
    • The Active Directory organizational structure is depicted in Figure 7-47.

    Applying Group Policy and Permissions

    • Group Policy applies to Organizational Units (OUs) in a domain.
    • An Organizational Unit typically contains user groups, with each user group having multiple users.
    • User groups within an Organizational Unit can have two or more users.
    • NTFS and Share Permissions are used to control access to resources in a domain.
    • These permissions apply to folders, managing access to resources within them.

    Accessing the Domain Controller

    • Three methods to access the domain controller: sitting at the computer, remote access to Windows Server, and using AD Administrative Center and PowerShell

    Creating a New User

    • Use Server Manager to create a new user
    • Follow the outlined steps to complete the new user creation process

    Best Practices for Password Options in AD

    • Always require a password for user accounts

    Password Complexity Requirements

    • Minimum of 8 characters in length
    • Must contain a mix of:
      • Lowercase letters
      • Uppercase letters
      • Numbers
      • Symbols
    • Cannot contain any three consecutive letters found in the:
      • User name
      • Display name

    Password Management Options

    • Require users to change their password at next logon
    • Avoid checking "Password never expires" for security reasons
    • "Account is disabled" option is useful for setting up accounts in advance of their actual use

    Managing User Accounts in AD

    • An account may get locked due to excessive failed sign-in attempts
    • To unlock a locked account:
      • Locate the account, right-click it, and select Properties
      • In the Properties box, select the Account tab, check Unlock account, and click Apply
    • To reset a forgotten password:
      • Locate the account, right-click it, and select Properties
      • Click Reset Password
    • Options to disable and delete an account are available in the Reset Password section

    User Account Properties

    • A user account can have various properties, including Member Of, Password Replication, Address, Account, Dialin, and Environment.
    • The Member Of property can have values such as Sessions and General.
    • The Password Replication property can have values such as Remote control and Profile.
    • The Address property can have values such as Remote Desktop Services and Telephones.
    • The Account property can have values such as Profile and COM-.
    • The Dialin property can have values such as Organization.

    User Logon Name

    • A user logon name can be in the format of an email address, such as [email protected].
    • A user logon name can also be in the pre-Windows 2000 format, such as HOMERUN\lucas_williams.

    Logon Hours and Log On To

    • Logon hours and log on to options can be configured for a user account.

    Account Options

    • Options can be set to control password behavior, such as:
      • User must change password at next logon
      • User cannot change password
      • Password never expires
      • Store password using reversible encryption

    Account Expiration

    • An account can be set to expire at a specific time, such as the end of a specific date (e.g. Tuesday, November 6, 2018).
    • An account can also be set to never expire.

    Resetting a User Password

    • The password reset dialog window contains four fields: New password, Confirm password, User must change password at next logon, and Unlock the user's account.
    • The dialog window displays a message reminding the user to log off and log on again for the change to take effect.
    • The "Account Lockout Status" is set to Unlocked after resetting the password.
    • The dialog window has two buttons: OK and Cancel.
    • The window is used to reset a user's password in Active Directory (AD).

    Managing User Accounts in Active Directory

    • Disable the Guest account to prevent unauthorized access
    • Implement logon time restrictions to schedule routine maintenance during off-peak hours
    • Set timeout and screen lock policies to limit the duration of disconnected sessions and require users to log back in
    • Ensure administrators use strong passwords to protect against unauthorized access
    • Configure home folders to redirect to a network share using folder redirection
    • Utilize logon scripts to execute specific tasks or settings during user logon

    Group Policy Objects

    • Group Policy can be used to create Group Policy Objects (GPOs) on a domain controller
    • GPOs contain policies that apply to a specific Organizational Unit (OU)
    • Creating and editing a GPO is possible, but managing GPOs using Group Policy is beyond the scope of this book
    • This book provides a brief overview of the process of creating and editing a GPO

    Creating a new GPO for the Domain Users OU

    • To create a new GPO, navigate to the Domain Users folder within the Group Policy Management Console.
    • Right-click the Domain Users OU and select New GPO to initiate the creation process.
    • The new GPO requires a name, which in this case is GPO user startup.
    • Selecting OK after naming the GPO completes the creation process.

    Policy Application Order

    • Policy conflicts can arise when policies overlap
    • The order of policy application is crucial in resolving conflicts
    • The last policy applied takes precedence in case of conflicts

    Policy Application Hierarchy

    • The order of policy application is as follows:
      • Local policies
      • Site policies
      • Domain policies
      • OU policies
      • Enforced policies

    How Group Policies Are Applied

    • When conflicting policies exist, the final applied policy is determined by the policy source.
    • Local policies have the highest priority and are applied first.
    • If there is no local policy, site policies are applied, and if there is no site policy, domain policies are applied.
    • OU policies are applied last, and if they are enforced, they override other policies.
    • When a policy is enforced, it means that it cannot be overridden by other policies.
    • The resulting policy is the combination of all policies applied in the following order: Local, Site, Domain, OU.

    Determining Resulting Policies

    • To find out the resulting policies for a computer or user, there are two methods:
    • Method 1: Open a command prompt window and enter the rsop.msc command, which opens the Resultant Set of Policy (RSOP) window.
    • In the RSOP window, you can drill down to see the policies set for the computer or user.
    • Method 2: Open a command prompt window and enter the gpresult /v command, which displays the policies currently applied to the computer and user.

    Security Settings

    • The Default Domain Policy enforces a password history of 24 previously used passwords.
    • The minimum password age is set to 42 days in the Default Domain Policy.
    • There is a conflicting policy setting for minimum password age, which is set to 1 day in the Default Domain Policy.
    • The minimum password length is set to 7 characters in the Default Domain Policy.
    • Passwords must meet complexity requirements, as enabled in the Default Domain Policy.
    • Storing passwords using reversible encryption is disabled in the Default Domain Policy.
    • The account lockout threshold is set to 0 invalid logon attempts in the Default Domain Policy.

    Password Security

    • A long password is considered a strong password, providing better security.

    Windows Computer Security

    • Local Group Policies and Local Security Policies are used to secure a Windows computer.

    Internet Explorer Settings

    • The Internet Options dialog box is used to manage various Internet Explorer settings.

    File Encryption

    • Encrypting File System (EFS) is used to encrypt files and folders on an NTFS file system.
    • BitLocker Drive Encryption is used to encrypt an entire volume on a hard drive.

    Network Access Control

    • Access to folders and files on a network is controlled by:
      • Assigning privileges to user accounts.
      • Assigning permission to folders and files.
    • The principle of least privilege should be applied when assigning privileges to users.
    • Customized user groups can be created to simplify the management of privileges for multiple user accounts.

    File Sharing on the Network

    • There are two ways to share files and folders on the network: workgroup sharing and domain controllers.
    • Mapped network drives enable users to access drives and folders on the network more easily.

    Active Directory (AD)

    • AD is a suite of services and databases provided by Windows Server to manage Windows domains.
    • AD organizes resources in a top-down hierarchical structure.

    AD Structure

    • A forest contains a domain.
    • Domains can contain sites.
    • Domains are organized into organizational units (OUs) and sub-organizational units.

    Resource Management in AD

    • Managing resources in AD revolves around Organizational Units (OUs), user groups, and NTFS and share permissions.

    Active Directory Features

    • Active Directory allows changing the Home folder location to a share on the network, a feature known as folder redirection.

    Group Policy Application

    • Group policies are applied in a specific order: local, site, domain, OU, and enforced.
    • In the event of a conflict between policies, the last policy applied takes precedence.

    Studying That Suits You

    Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

    Quiz Team

    Related Documents

    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG
    Capture.PNG

    Description

    Learn about the basics of controlling access to computer resources, including authentication and authorization, and how Windows Active Directory handles user authentication.

    More Like This

    Single Sign-On and Kerberos Authentication Quiz
    4 questions

    Single Sign-On and Kerberos Authentication Quiz

    LucrativeMagenta avatar
    LucrativeMagenta
    Windows Troubleshooting Commands
    92 questions

    Windows Troubleshooting Commands

    FairDaffodil avatar
    FairDaffodil
    Windows Security Flashcards
    20 questions

    Windows Security Flashcards

    EvaluativeQuantum avatar
    EvaluativeQuantum
    Windows Event Viewer Flashcards
    20 questions

    Windows Event Viewer Flashcards

    CalmingCornet avatar
    CalmingCornet
    Use Quizgecko on...
    Browser
    Open
    Browser
    Browser