Password Policies

You can protect user accounts on a domain by applying password policies to the domain user accounts. You can ensure that the users do not use the.same password by applying password history options. The age for a password determines the validity of the password. You can secure the password by implementing maximum and minimum ages for the password. The default age of a password in Windows Server 2003 is 42 days. You can also set a length for the password using the minimum password length feature. In addition, you can secure passwords by enabling complexity requirements for passwords and storing passwords using reversible encryption methods.

The default password policies in Windows Server 2003 are:

> Enforce password history - Specifies the number of passwords the user can reuse before creating a new password

> Maximum password age - Specifies the time for expiry of the password. Windows Server 2003 prompts the user to change the password when the password expires.

> Minimum password age - Species the time for which the user can use a password

> Minimum password length - Specifies the number of characters the password must contain

> Password must meet complexity requirements - Specifies that the password must meet the complexity requirements

> Store passwords using reversible encryption - Specifies to store passwords

To view default password policies:

1. Open the Group Policy Object Editor console. The Group Policy Object Editor console appears.

2. Expand Windows Settings under Computer Configuration.

3. Expand Security Settings under Windows Settings.

4. Expand Account Policies under Security Settings.

5. Click Password Policy. The Password Policy appears.

To set password history options:

1. Open Group Policy Object Editor console. The Group Policy Object Editor console appears.

2. Expand Windows Settings under Computer Configuration.

3. Expand Security Settings under Windows Settings.

4. Expand Account Policies under SecurIty Settings.

5. Click Password Policy. The Password Policy appears

6. Double-click Enforce password history. The Enforce password history Properties dialog box appears.

7. Select the Define this policy settIng check box.

8. Enter the value in the passwords remembered spin box.

9. Click Apply.

10. Click OK.

To set the Maximum age for passwords:

1. Open Group police Object Editor console. The Group Policy Object Editor console appears

2. Expand Windows Settings under Computer Configuration.

3. Expand Security Settings under Windows Settings.

4. Expand Account Policies under Security Settings.

5. Click Password Policy. The Password Policy appears.

6. Double-click Maximum password age. The Maximum password age Properties dialog box appears.

7. Select the Define this policy setting check box.

8. Enter the value in the days spin box.

9. Click Apply.

10. Click OK.

To set the Minimum Age for passwords:

1. Open Group Policy Object Editor console. The Group Policy Object Editor console appears

2. Expand Windows Settings under Computer Configuration.

3. Expand Security Settings under Windows Settings.

4. Expand Account Policies under Security Settings.

5. Click Password Policy. The Password Policy appears.

6. Double-click Minimum password age. The Minimum password age Properties dialog box appears.

7. Select the Define this policy setting check box.

8. Enter the value in the days spin box.

9. Click Apply.

10. Click OK.

To set minimum length for the password:

1. Open Group Policy Object Editor console. The Group Policy Object Editor console appears.

2. Expand Windows Settings under Computer Configuration.

3. Expand Security Settings under Windows Settings.

4. Expand Account Policies under Security Settings.

5. Click Password Policy. The Password Policy appears

6. Double-click Minimum password length. The Minimum password length Properties dialog box appears.

7. Select the Define this policy setting check box.

8. Enter the value in the characters spin box.

9. Click Apply.

10. Click OK.

Account Policies

Account policies enable the system administrator to control the user accounts. Using an account policy, the administrator can:

> Set the account lockout duration - Specifies the time after which the account will be locked

> Set the account lockout threshold - Specifies the number of invalid attempts to login to the domain

>Reset the account lockout count - Specifies to restart the account lockout count

To view account policies:

1. Open Active Directory Users and Computers. The Active Directory Users and Computers console appears.

2. Select the domain controller name.

3. Select Action -> Properties. The Properties dialog box appears.

4. Click the Group Policy tab. The Group Policy tab appears.

5. Select the Default Domain Policy.

6. Click Edit. The Group Policy Object Editor console appears.

7. Expand Windows Settings under Computer Configuration.

8. Expand Security Settings under Windows Settings.

9. Expand Account Policies under Security Settings.

10. Click Account Lockout Policy. The Account Lockout Policy appears.

The different account policies that appear in the Account Lockout Policy are:

> Account lockout duration - Specifies the time after which the account is locked out

> Account lockout threshold - Specifies the number of incorrect attempts, the user can make, before the account is locked

> Reset account lockout count after - Specifies to enable default settings for the account lockout policy.

To set Account Lockout Duration:

1. Open the Group Policy Object Editor console. The Group Policy Object Editor console appears.

2. Expand Windows Settings under Computer Configuration.

3. Expand Security Settings under Windows Settings.

4. Expand Account Policies under Security Settings.

5. Click Account Lockout Policy. The Account Lockout Policy appears.

6. Double-click Account lockout duration. The Account lockout duration Properties dialog box appears.

7. Select the Define this policy setting check box. The minutes spin box is enabled.

8. Enter the time in the minutes spin box.

9. Click Apply.

10. Click OK.

To set Account Lockout Threshold:

1. Open the Group Policy Object Editor console. The Group Policy Object Editor console appears.

2. Expand Windows Settings under Computer Configuration.

3. Expand Security Settings under Windows Settings.

4. Expand Account Policies under Security Settings.

5. Click Account Lockout Policy. The Account Lockout Policy appears.

6. Double-click Account lockout threshold. The Account lockout threshold Properties dialog box appears.

7. Select the Define this policy setting check box.

8. Enter the value in the invalid logon attempts spin box.

9. Click Apply.

10. Click OK.

To reset the Account Lockout Count:

1. Open the Group Policy Object Editor console. The Group Policy Object Editor console appears.

2. Expand Windows Settings under Computer Configuration.

3. Expand Security Settings under Windows Settings.

4. Expand Account Policies under Security Settings.

5. Click Account Lockout Policy. The Account Lockout Policy appears.

6. Double-click Reset account lockout count after. The Reset account lockout count after Properties dialog box appears.

7. Select the Define this policy setting check box. The minutes spin box is enabled.

8. Enter the time in the minutes spin box.

9. Click Apply.

10. Click OK.

Securing Domain User Accounts

Users access the network resources, using a domain user account. There are chances that other users can misuse the user account. You can secure the user accounts prevent misuse of the accounts. The user account can be tampered by deleting important files and hacking account passwords.

You can secure the user accounts to solve these problems. You can implement account policies to prevent consecutive attempts to access the domain using incorrect passwords. In addition, you can control password hacking by implementing password polices.

Disabling and Enabling ComDuter Accounts

Consider a scenario, where an employee of a company is on a holiday. You do not want other users to access the network using the employee’s computer. You can disable the account so that other users cannot access the network using the employees account. After the employee returns from the holiday, you can permit access to the employee’s account by enabling the computer account.

To disable a Computer Account:

1. Open Active Directory Users and Computers console. The Active Directory Users and Computers console appears.

2. Click Computers. The list of computers appears.

3. Select the computer account to disable.

4. Select Action -> Disable Account. The Active Directory Confirmation message box appears.

5. Click Yes. The Object Disabled message box appears.

6. Click OK. Windows Server 2003 disables the computer account and displays a red cross symbol against the account.

Reset Computer Accounts

You reset the computer account to fix the errors the account. Windows Server 2003 restores the computer account to default settings when you reset the account.

To reset the computer account:

1. Open Active Directory Users and Computers console. The Active Directory Users and Computers console appears.

2. Click Computers. The list of computers appears.

3. Select the computer to reset.

4. Select Action -> Reset Account. The Confirmation message box appears.

5. Click Yes. The Active Directory message box appears.

6. Click OK. Windows Server 2003 resets the computer account.

Move Computer Accounts

You can move computers to different objects in the domain. A computer account is assigned permissions when you move the computer account to another location. You can move a computer account anywhere in the domain. You must possess administrative rights to move computer accounts. In addition, you can move computer accounts across domains. You must move computer accounts in the domain to restrict permissions and ensure security. You can use the Move tree tool to move computer accounts across domains.

To move a Computer Account:

1. Open Active Directory Users and Computers console. The Active Directory Users and Computers console appears.

2. Click Computers. The list of computers appears.

3. Select the computer to move.

4. Select Action -> Move. The Move dialog box appears.

5. Select the object to move the computer account.

6. Click OK. Windows Server 2003 moves the computer account to the specified object.

Adding Computer Account to Groups

The computer account on a domain enables the domain to communicate with the client computer. You can restrict access to the computer accounts by adding them to groups. The computer becomes a member of the group when you add a computer to the group. The group permissions are assigned to the computer when the computer becomes a member of the group. You can restrict the computer in a domain by adding the computer to groups and assigning permissions to groups. For example, if a group is denied permission to a network resource and the computer is a member of the group, the computer is denied access to the resource.

To add computer account to a group:

1. Open Active Directory Users and computers console. The Active
Directory Users and Computers console appears.

2. Click computers. The list of computers appears.

3. Select a computer.

4. Select Action 4 Properties. The Properties dialog box appears.

5. Click the Member of tab. The Member of tab appears.

6. Click Add. The Select Groups dialog box appears.

7. Enter the group name in the Enter the object names to select text area.

8. Click OK. Windows Server 2003 adds the Computer-1 account to the group.

Create Computer Account

You can create computer accounts to enable network computers communicate with the domain. Windows Server 2003 creates a computer account when you add the computer to the domain.

To create a computer account:

1. Select Start > All Programs > Administrative Tools > Active Directory Users and Computers. The Active Directory Users and Computers console appears.

2. Click Computers. The list of computers appears.

3. Select Action > New > Computer. The New Object - Computer dialog box appears.

The different options on the New Object-Computer dialog box are:

> Computer name - Specifies a name for a Windows 2000 computer account

> Computer name (pre-Windows 2000) - Specifies a name for a computer running versions earlier than Windows 2000

> User or group - Specifies the group the computer will belong to

> Assign this computer account as a pre-windows 2000 computer - Specifies to create a

> Assign this computer account as a backup domain computer - Specifies to create a backup domain controller for the computer account.

4. Enter the name for the computer in the Computer name text box, for example, Computer-1.

5. Click Next. The Managed dialog box appears.

6. Click Next. The Summary screen appears.

7. Click Finish. Windows Server 2003 creates the Computer-1 account and lists it under Computers.

Computer Accounts

A Windows Server 2003 domain controller communicates with the client computers using the computer account. The computer account authenticates the computer on the domain and enables to access the domain as well as the network resources.

Enable and Disable User Accounts

Consider a scenario, where an employee of a company, Steve Martins is on a holiday. You do not want other users to access Steve Martins account. You can disable the account so that other users cannot access the uses account. After Steve Martins returns from the holiday, you can permit access to Steve Martins account by enabling the user account.

To disable Steve Martins account:

1. Open Active Directory Users and Computers console. The Active Directory Users and Computers console appears.

2. Click Users. The list of users appears.

3. Select Steve Martins.

4. Select Action -> Disable Account. Windows Server 2003 disables the account and displays a message box.

5. Click OK.

To enable Steve Martins account:

1. Open Active Directory Users and Computers console. The Active Directory Users and Computers console appears.

2. Click Users. The list of users appears.

3. Select Steve Martins.

4. Select Action -> Enable Account. Windows Server 2003 enables the account and displays a message box.

5. Click OK.

Moving User Accounts

You can move accounts in the domain to secure access to the domain. When you move users, the users are granted permissions according to the location. For example, as a system administrator, you are asked to move Steve Martin’s account.

To move the Steve Martins account:

1. Open Active Directory Users and computers. The Active Directory Users and Computers console appears.

2. Click Users. The list of users appears.

3. Select Steve Martins.

4. Select Action -> Move. The Move dialog box appears.

5. Select the location to move Steve Martins account, for example, Computers.

6. Click OK. Windows Server 2003 moves the Steve Martins account under Computers.

Set Logan Computer

In addition to logon hours, you can restrict the user to use a specific computer on the domain. When you set a logon computer for a user account, the user can login to the domain using that computer only. The user is denied access to the domain when the user attempts to logon to the domain using other computers.

Consider a scenario, where the employee, Steve Martins is violating the privacy of other employees. He uses other employees’ computer to logon to the domain. The user can view confidential data on other computers. You must ensure that Steve Martins does not access the domain using other computers.

To set the computer to logon for Steve Martins user account:

1. Open the Steve Martins Properties dialog box. The Steve Martins Properties dialog box appears.

2. Click the Account tab. The Account tab appears.

3. Click Log On To. The Logon Workstations dialog box appears.

The different options on the Logon Workstations dialog box are:

> All computers - Specifies that the user can logon to the domain using any computer

> The following computers - Specifies that the user can logon to the domain only using the specified computers

> Computer name - Specifies the computer name to deny logon

> Add - Includes the computer in the Computer name list

> Edit - Modifies the computer name in the list

> Remove - Deletes the computer from the Computer name list

4. Select the The following computers option.

5. Enter the name of the computer in the Computer name text box.

6. Click Add. Windows Server 2003 adds the computer to the list.

7. Click OK to close the Logon Workstations dialog box.

8. Click Apply in the Account tab of Steve Martins Properties dialog box.

Set Loaon Hours

You, as a system administrator, can restrict a user from accessing the domain resources. You can set logon restrictions for a user account by specifying the time when the user must be permitted to logon to the domain. You can also restrict domain access to a user by specifying the time, so that the user cannot access the domain. For example, a new employee, Steve Martins, is accessing the domain on holidays, such as, on Sunday. You as a system administrator are told to restrict Steve Martin’s access to the domain on Sundays.

To set logon hours for Steve Martins account:

1. Open Active Directory Users and Computers. The Active Directory Users and Computers console appears.

2. Click Users. The list of users appears.

3. Select Steve Martins.

4. Select Action > Properties. The Properties dialog box appears.

5. Click the Account Tab. The Account tab appears,

6. Click Logon Hours. The Logon Hours dialog box appears.

7. Click Sunday. Windows Server 2003 selects the entire timeslot for Sunday.

8. Select Logon Denied option. Windows Server 2003 highlights the timeslot for Sunday in White color.

9. Click OK.

Reset Account Password

The new employee, Steve Martins is not able to logon to the domain. The user has forgotten the password for the account. You can ensure Steve Martins logs in to the domain by resetting the password for his account.

To reset the password for the Steve Martins account:

1. Open Active Directory Users and Computers. The Active Directory Users and Computers console appears.

2. Click Users. The list of users appears.

3. Select the user to reset the password.

4. Select Action -> Reset Password. The Reset Password dialog box appears.

5. Enter the new account password in the New password text box.

6. Re-enter the account password in the Confirm password text box

7. Click OK. The Active Directory message box appears.

8. Click OK.

Managing Accounts

You can manage the domain user accounts by performing tasks, such as, Reset the account password, set logon hours, set the computer to logon, move the user account, enable and disable a user account, and delete a user account.




More Tutorials:

• Reset Account Password
• Set Loaon Hours
• Set Logan Computer
• Moving User Accounts
• Enable and Disable User Accounts
• Computer Accounts
• Create ComDuter Account
• Adding Computer Account to Groups
• Move Computer Accounts
• Reset Computer Accounts

Domain User Accounts

The domain user account stores information about the user, such as, the username, password, and the logon name. The domain user account validates the user when the user logs on to a Windows Server 2003 domain. The domain user account verifies the user information and enables the user to access resources when the user attempts to logon to the domain.

Windows Server 2003 enables you to create a domain user account only after configuring the Windows Server 2003 computer as a domain Controller. Consider a scenario, a candidate, Steve Martins is appointed as a Technical Support Executive. You, as the system administrator, have been assigned the task to create a user account for Steve Martins to enable him to work on the domain.

To create a Domain User Account for Steve Martins:

1. Select All Programs > Administrative Tools > Active Directory Users and Computers. The Active Directory Users and Computers console appears.

2. Click Users. The list of users appears.

3. Select Action > New > User. The New Object - User dialog box appears,

The different options on the New Object - User dialog box are:

> First name - Specifies the first name for the user

> Initials - Specifies the initials for the user

> Last Name - Specifies the last name for the user

> Full name - Specifies the complete name for the user account

> User logon name - Specifies the name the user will use to logon to the network

> User logon name (pre-Windows 2000) - Specifies the name the user will use to logon to the network

> a version earlier than Windows 2000

4. Enter Steve in the First name text box.

5. Enter Martins in the Last name text box.

6. Enter Steve in the User logon name text box.

7. Click Next. The Password screen appears.


The different options available on the Password screens are:

> Password - Specifies to enter a password for the user account

> Confirm password - Specifies to renter the password for the user account for confirmation

> User must change password at next logon - Specifies that the user must change the password at the next logon

> User cannot change password - Prevents the user from changing the password

> Password never expires - Specifies that the password must never be changed

> Account is disabled - Specifies that the user cannot use the account to access the computer

8. Enter a password for Steve’s account in the Password text box.

9. Re-enter the password for Steve’s account in the Confirm password text box.

10. Select the User must change password at next logon check box.

11. Click Next. The Summary screen appears.

12. Click Finish. Windows Server 2003 creates the account and lists the account under Users in the Active Directory Users and Computers console.

WORKING WITH DOMAIN ACCOUNTS

The domain user account enables the user to logon to the domain and access domain resources. The client computer in a network communicates with the domain controller with a computer account. Windows Server 2003 creates a computer account when you add the computer to the domain. You can also secure domain user accounts by implementing account and password policies.


More Tutorials:

• WORKING WITH DISK STORAGE
• Types of Disk Storage
• chkdsk Tool
• Disk Defragmenter
• Domain User Accounts
• Managing Accounts
• Reset Account Password
• Set Loaon Hours
• Set Logan Computer
• Moving User Accounts
• Enable and Disable User Accounts
• Adding Computer Account to Groups
• Reset Computer Accounts
• Securing Domain User Accounts
• Account Policies
• Password Policies

Managing User Groups

You can make a user account a member of more than one group to restrict the user’s access to resources on the local computer and the network. For example, you can add a user to the User group and the Guests group. When you add a user to more than one group, the deny permission of a group overrides the allow permission of the other group. For example, user is a member of the Users group. If you add the same user to the Guests group, the permissions of the guests group overrides the permissions of the users group.

To add a user to a group:

1. Open the Computer Management Console.

2. Expand Local Users and Groups.

3. Click Groups. A list of groups appears.

4. Select the group to add users.

5. Select Action -> Properties. The Group Properties dialog box appears.

The options available in the Group Properties dialog box are:

> Description - Provides an explanation about the group

> Add - Specifies to add a user to the group

> Remove - Specifies to delete a user from the group

6. Click Add The Select Users dialog box appears.

7. Enter the user name in the Enter the object names to select text area, for example User.

8. Click OK. The Added user appears.

9. Click Apply.

Installing Active Directory

The Active Directory service in Windows Server 2003 monitors and manages the logon process of users in the network. The Active Directory service enables the domain administrator to set permissions for the user accounts. Windows Server 2003 configures the computer as a domain controller when you install Active Directory services.

To install Active Directory:

1. Select All Programs > Administrative Tools > Configure Your Server Wizard. The Configure Your Server wizard appears.

2. Click Next. The preliminary steps screen appears.

3. Click Next. The Server Role screen appears.

4. Select the Domain Controller (Active Directory) option from the Server Role list.

5. Click Next. The Summary of Selections screen appears.

6. Click Next. The Active Directory message box appears.

7. Click Continue. The Active Directory instailation Wizard appears.

8. Click Next. The Operating System Compatibility screen appears.

9. Click Next. The Domain Controller Type screen appears.

The different options on the Domain Controller Type screen are:

> Domain controller for a new domain - Creates a new domain controller

> Additional domain controller for an existing domain - Creates a domain controller for an existing domain

10. Select the Domain controller for a new domain option.

11. Click Next. The Create New Domain screen appears.

12. Select the Domain In a new forest option.

13. Click Next. The New Domain Name Screen appears.

14. Enter the name for the domain in the Full DNS name for new domain text box, for example, Jupiter.

15. Click Next. The Confirmation message box appears.

16. Click Yes. Windows Server 2003 creates the Net BIOS name for the domain controller,

17. Click Next. The Database and Log Folders screen appears.

18. Click Next. The Shared System Volume Screen appears

19. Click Next. The DNS Registration Diagnostics screen appears.

20. Select the I will correct the problem later by configuring DNS manually (Advanced) option.

21. Click Next. The Permissions screen appears.

22. Select the Permissions compatible only with Windows 2000 or Windows Server 2003 operating systems option.

23. Click Next. The Directory Services Restore Mode Administrator Password screen appears.

24. Enter a password in the Restore Mode Password text box.

25. Re-enter the password in the Confirm password text box.

26. Click Next. The Summary screen appears.

27. Click Next. Windows Server 2003 installs the Active Directory services on the computer and prompts to restart the computer.

28. Click Restart Now. After you restart the server, the Configure Your Server Wizard screen appears.

29. Click Finish.

Creating Local User Groups

You create groups to store and manage multiple users, and computers with similar rights and permissions.

To create a new group:

1. Open Computer Management. The Computer Management console appears.

2. Expand Local Users and Groups.

3. Click Groups. The Default list of groups appears.

4. Select Action -* New Group. The New Group dialog box appears.

The different options available on the New Group dialog box are:

> Group name - Specifies a name for the group

> Description - Provides a description for the group

> Members - Lists the users in the group

> Add - Includes a user in the group

> Remove - Deletes the selected user from the group

> Create - Generates a group with the specified name

5. Enter the name for the group in the Group name text box, for example, Windows 2003.

6. Click Create. Windows Server 2003 creates the new local user group.

Local User Groups

The user groups contain the rights and permissions for the users in the group. The users in groups can execu1e basic tasks, such as file sharing, accessing files and folders. Windows Server 2003 creates some default groups when you install Windows Server 2003.

The default groups that are created as follows:

> Administrators Group - Enables full rights and privileges on the computer on which the account is created. The members of this group grant permissions to users and groups. The administrator has full rights to access default local groups and create new groups for the users. The administrator must consider that the existing local group meets the requirements before creating a new group.

> Backup Operators Group - Possesses the rights and permissions only to back up and restore the file system. The backup operators are granted permission only take backup. The permission to the backup operators overrides the permissions granted to files and folders only for the backup process. the members of this group do not have rights to change security settings of the system. The backup operators can only access the file system through backup utility.

> Users Group - Permits limited access to network resources, such as, printers, and applications. members of this group have rights only to view the contents. The users in this group can only view the system settings. The users cannot modify the system configuration.

> Guests Group - Provides very limited access to the computer. The members of the guest group can only view the files and folders. The guest users are further restricted access to the system areas, such as, the system root folder and the device manager.

> Power Users Group - Provides permissions more than the users group. The power users possess some of the administrative rights. The members of the Power Users can create user accounts but they cannot modify and delete the accounts.

> Replicator Group - Performs Active Directory replication functions. The replication function includes tasks, such as, replicating files and replicating folders. This group enables you to replicate the files in a domain.

> Print Operators Group - Enables to carry out the printer functions. The printer functions include tasks, such as, installing printers, configuring printers, and managing printers. The accounts in this group are given permissions only for managing the print operations.

User Account Profile

The operating system stores the user account settings such as, desktop settings, display settings, Mouse settings, Printer settings, Network settings. Windows Server 2003 saves this information in the system root drive under the Documents and Settings folder. These settings are identified as user profiles. When the user logs of from the network, the profile is updated in the computer from where the user logged in. There are four types of user profiles, such as, default profile, local profile, roaming profile and mandatory profile.

Windows Server 2003 supports two types of user profiles, such as:

> Local Profile - Enables to create a profile for the user account when the user logs in to the computer for the first time. Windows Server 2003 enables you to create multiple local profiles on a computer. You can create local profiles for users who share the same computer.

> Roaming Profile - Enables to create a profile for the user to access the network using any computer on the network. The system administrator creates a roaming profile and saves them on a network server. Therefore, a user can access the profile from any computer on the network. You can create a roaming profile for a user account who wants to access more than one computer on a network.

To create a user profile:

1. Open Computer Management. The Computer Management console appears.

2. Expand Local Users and Groups.

3. Click Users. A list of users appears.

4. Select the user for which you want to create the profile.

5. Select Action 4 Properties. The Properties dialog box appears.

6. Click the profile tab. The profile tab appears.

The different options on the Profile tab are:

> Profile path - Specifies the location to save the user profile

> Logon script - Specifies the program to start when the user logs in

> Local path - Specifies the path of the local folder to start at logon

> Connect - Specifies to connect to the specified location

7. Enter the location for the profile in the Profile path text box, for example, d:\user.

8. Click Apply.

9. Click OK.

10. Log off the computer.

11. Login as user.

12. Modify settings under the user account, for example, Change the background color of the desktop and disable the screen saver.

13. Log off and login again using the user account.

14. Open the user folder. Windows Server 2003 creates the profile for the user account in the d:\user folder.

Home Folders

You, as a system administrator, must ensure that the user stores the files at a single location by creating a home folder for the user account. The home folder can be a folder on the local computer or a folder on the network. When you create a home folder for a user account, the folder becomes the default location for the user account save files and folders. The administrator can assign a home folder to more than one user account.

To assign a home folder for a local user account:

1. Open the Computer Management Console. The Computer Management console appears.

2. Click Users and Groups. The list of users and groups appears.

3. Select the user account.

4. Select Action - Properties. The Properties dialog box appears.

5. Select the Profile tab. The Profile tab appears.

6. Select the Connect option.

7. Enter the location of the folder in the To text box.

8. Click Apply.

9. Click OK.

Managing User Accounts

You can create user accounts to enable user to access the system resources. The administrator can create home folders for the user account to collect the files of the user at a single location. You can also create a profile for a user account. The profile for a user account saves the user account settings on the network. Using the profile the user can login to any computer on the network.

Local User Accounts

A user account stores information about the user, which includes the user name, password, and log on name. Local user accounts indicate that you can access these accounts only on the computer on which you create the user account. In addition, you can enable the user to access network resources when the user logs on to the network, using the computer on which you create local user accounts.

Windows Server 2003 creates the following accounts by default during the setup process:

> Administrator Account - Provides full access to computer resources and applications. The administrator can create and manage user accounts. You are prompted to create a strong and secured password for the administrator account during Windows Server 2003 setup The administrator account cannot have a blank password.

> Guest Account - Provides limited access. The guest account has read only access. Read only access means that the guest user can only view the contents of the folders. The guest account is also restricted to access specific system folders, such as, the Windows and the Program Files directory. Windows Server 2000 disables the guest account by default.

You cannot delete these user accounts. You can create additional user accounts to enable users to gain access . the computer.

To create a local user account:

1. Select Start > Administrative Tools > Computer Management. The Computer Management console appears.

2. Expand Local Users and Groups.

3. Click Users. The Default List of User Accounts appears,

4. Select Action 3 New User. The New User dialog box appears,

The different options in the New User dialog box are:

> User Name - Specifies the user name for the account

> Full Name - Specifies the complete name for the account

> Description - Specifies a description for the account

> Password - Specifies a password for the user account

> Confirm password - Specifies to retype the password

> User must change password at next logon - Specifies that the user must change the password at the next logon

> User cannot change password - Prevents the user from changing the password

> Password never expires - Specifies that the password must never be changed

>Account is disabled - Specifies that the user cannot use the account to access the computer

5. Enter the user name in the User Name text box

6. Enter the full name of the user in the Full Name text box.

7. Enter a description for the user account in the Description text box.

8. Enter a password for the account in the Password text box.

9. Re-enter the password for the account in the Confirm password text box.

10.Select the User must change password at next logon check box.

11. Click OK. Windows Server 2003 creates the user account and lists the account under users in the Computer Management console.

WORKING WITH LOCAL USER ACCOUNTS AND GROUPS

Windows Server 2003 creates default users and groups when you install the operating system. Windows Server 2003 enables you to access the computer using local user accounts and groups. You can create local user accounts to enable users to access the Windows Server 2003 computer. You can also create local user groups and add users to these groups. You can restrict the user permissions when you add users to groups. In addition,you can install Active Directory services to enable users to access the domain resources by configuring the as a domain controller.