2.5 – Windows Security - Windows Security Settings

• Most operating systems require a login, including Windows.
• There are numerous options for logging in.

Login Options

• Local accounts are stored on the device and only log in to that specific Windows device.
• Microsoft accounts are configured on the Microsoft Cloud and can be used to log in to the local device and integrate Microsoft technologies like Skype, Office, and OneDrive.
• Windows domain credentials are used in office or enterprise environments.

Account Storage

• Local account details are stored under local users and groups.
• This contains a list of all users who can log in and their rights and permissions.
• Users can be added to groups to provide rights and permissions, such as the administrators group for administrative access or the event log readers group.

Login Credentials

• Username and password are the most common login credentials.
• Other options include a personal identification number (PIN) and biometrics (facial recognition).
• Windows domains offer single sign-on

Modifying Login Methods

• Adjustments to login methods can be found under accounts and sign-in options.
• Available options are facial recognition, fingerprint recognition, PIN, security key, password, or picture password.

NTFS Permissions

• Rights and permissions on a local device are based on the permissions associated with NTFS.
• Every file or folder in NTFS has a Security tab to specify group or user access rights and permissions.

Share Permissions

• Connecting across a network involves share permissions.
• These permissions are associated with access to the share across the network.
• NTFS permissions for that user must also be considered.
• The most restrictive access takes priority.

Permission Inheritance

• NTFS permissions are inherited from the parent folder.
• Moving an NTFS file or folder to a different folder on the same volume retains the original permissions.

NTFS vs. Share Permissions

• NTFS permissions offer a large number of configurable permissions.
• Full control, modify, read and execute, and list folder contents.
• Share permissions allow assignment of users and groups.
• Limited permission options, full control, change, and read.

Explicit vs. Inherited Permissions

• Explicit permissions are those assigned to objects in the file system.
• Inherited permissions are automatically associated with an object.
• Based on the parent of that particular object.
• Assigning or denying access to a folder affects all subfolders.
• Explicit permissions override inherited permissions.

Elevated Accounts

• Normal users have restricted access to certain parts of the operating system.
• Elevated accounts or administrator rights are needed to edit system files, install services, and provide enhanced functions.
• Right-clicking an application and choosing "Run As Administrator" starts it with elevated rights.

User Account Control (UAC)

• UAC limits capabilities for users.
• Requires approval before certain features are run.
• UAC windows may appear for standard users when using the network or changing passwords.
• Administrators may see UAC windows when installing applications or updating device drivers.
• The secure desktop screen allows users to understand changes and potential risks.
• Unexpected UAC prompts should be carefully examined to determine if elevated permissions are appropriate.

BitLocker

• BitLocker encrypts everything on a Windows system, including personal files and the operating system.
• Protects data if a laptop is lost or stolen.
• BitLocker To Go encrypts data written to USB flash drives.

Encrypting File System (EFS)

• EFS encrypts specific files or folders.
• It is built into NTFS
• Works in all Windows editions except the home editions.
• Encryption key is based on the user's username and password.
• Resetting the password may result in losing access to all EFS encrypted data.