Microsoft designed the User Accounts control panel and the Local Users And Groups snap-in for computer users with different levels of expertise, and they provide different degrees of access to the SAM, as follows:
-User Accounts Provides a simplified interface with limited access to user accounts. By using this interface, you can create local user accounts and modify their basic attributes, but you cannot create groups or manage group memberships (except for that of the Administrators group).
-Local Users And Groups Provides full access to local users and groups and all their attributes.
Using the User Accounts control panel
Windows Server 2012 R2 creates two local user accounts during the operating system installation process: the Administrator account and the Guest account. The setup program prompts the installer for an Administrator password during the installation, and the Guest account is disabled by default.
Once the installation process is completed, the system restarts. Because only the Administrator account is available, the computer logs on using that account. This account has administrative privileges, so at this point you can create additional user accounts or modify the existing ones.
-----------------
NOTE: CREATING LOCAL USERS
You can only create new user accounts in the control panel on Windows Server 2012 R2 computers that are part of a workgroup. When you join a computer to an AD DS domain, you must use the Local Users And Groups snap-in to create new local user accounts. Domain controllers have no local user or group accounts
-----------------
By default, the User Accounts control panel creates standard accounts. To grant a local user administrative capabilities, you must change the account type by using the interface shown in Figure 6-10.
FIGURE 6-10 The Change Account Type window
What the User Accounts control panel refers to as an account type is actually a group membership. Selecting the Standard option adds the user account to the local Users group, whereas selecting the Administrator option adds the account to the Administrators group.
Using the Local Users And Groups snap-in
By default, the Local Users And Groups snap-in is part of the Computer Management console. However, you can also load the snap-in by itself or create your own MMC with any combination of snap-ins you wish.
To create a local user account with the Local Users And Groups snap-in, use the following procedure.
1. In Server Manager, on the Tools menu, select Computer Management to open the Computer Management console.
2. Expand the Local Users And Groups node and click Users to view a list of the current local users.
3. Right-click the Users folder and, from the shortcut menu, select New User. The New User dialog box opens, as shown in Figure 6-11.
FIGURE 6-11 The New User dialog box
4. In the User Name text box, type the name you want to assign to the user account. This is the only required field in the dialog box.
5. Specify a Full Name and a Description for the account if desired.
6. In the Password text box and the Confirm Password text box, type a password for the account if desired.
7. Select or clear the four check boxes to control the following functions:
- User Must Change Password At Next Logon Selecting this check box forces the new user to change the password after logging on for the first time.
- User Cannot Change Password Selecting this check box prevents the user from changing the account password.
- Password Never Expires Selecting this check box prevents the existing password from ever expiring.
- Account Is Disabled Selecting this check box disables the user account, preventing anyone from using it to log on.
8. Click Create. The new account is added to the user list and the console clears the dialog box, leaving it ready for the creation of another user account.
9. Click Close.
10. Close the Computer Management console.
Creating a local group
To create a local group with the Local Users And Groups snap-in, use the following procedure.
1. In Server Manager, on the Tools menu, select Computer Management to open the Computer Management console.
2. Expand the Local Users and Groups node and click Groups to display a list of local groups.
3. Right-click the Groups folder and then, from the shortcut menu, select New Group. The New Group dialog box opens.
4. In the Group Name text box, type the name you want to assign to the group. This is the only required field in the dialog box. If desired, specify a Description for the group.
5. Click Add. The Select Users dialog box opens.
6. In the text box, type the names of the users whom you want to add to the group, separated by semicolons and then click OK. The users are added to the Members list.
You can also type part of a user name and click Check Names to complete the name or click Advanced to search for users.
7. Click Create to create the group and populate it with the user(s) you specified. The console then clears the dialog box, leaving it ready for the creation of another group.
8. Click Close.
9. Close the Computer Management console.
Local groups have no user-configurable attributes other than a description and a members list, so the only modifications you can make when you open an existing group are supplying a description and adding and removing members. As noted earlier in this lesson, local groups cannot have other local groups as members, but if the computer is a member of a Windows domain, a local group can have domain users and domain groups as members.
No comments:
Post a Comment