Authentication and Authorization

Authentication and Authorization

. Configure authentication and authorization

Cram Saver

1. What is the process used to confirm a user’s identity?

❍ A. Authentication ❍ B. Authorization ❍ C. Auditing ❍ D. Certificate

2. Which local user accounts are automatically created when you install a fresh copy of Windows 7 and are also disabled by default? (Choose all that apply.)

❍ A. Administrator ❍ B. Administrators ❍ C. RemoteIdentity ❍ D. Guest

Answers

1. A is correct. Authentication is the process used to confirm a user’s identi- ty, when he or she accesses a computer system or additional system resources. Answer B is incorrect because authorization occurs after authentication, which allows access to a network resource. Answer C is incorrect because auditing is the recording of activity to be used to track user actions. Answer D is incorrect because a digital certificate is a form of authentication.

2. A and D are correct. The built-in administrator account provides complete access to files, directories, and services. The Guest account is designed for users who need one-time or occasional access. The Administrator and Guest accounts are disabled by default. Answer B is incorrect because Administrators is a group, not an account. Answer C is incorrect because there is no user account called RemoteIdentity.

Authentication is the process used to confirm a user’s identity when he or she accesses a computer system or an additional system resource. The most com- mon authentication method is using a username and password. When working

Authentication and Authorization

with transactions over the Internet that deal with money, credit cards, or per- sonal information, username/password authentication has an inherent weak- ness given its susceptibility to passwords that can be stolen, accidentally revealed, or hacked.

Because of this weakness, these transactions usually employ digital certificates to prove the identity of users or companies and also contain an encryption key, which is used to encrypt data sent over the Internet.

Users must be authenticated to verify their identity when accessing files or other network resources over the network. The Windows 7 operating system includes the following authentication methods for network logons:

. Kerberos version 5 protocol: The main logon authentication method used by clients and servers running Microsoft Windows operating sys- tems. It is used to authenticate both user accounts and computer accounts.

. Windows NT LAN Manager (NTLM): Used for backward compati- bility with pre-Windows 2000 operating systems and some applications. It is less flexible, efficient, and secure than the Kerberos version 5 protocol.

. Certificate mapping: Typically used in conjunction with smart cards for logon authentication. The certificate stored on a smart card (about the size of a credit card) is linked to a user account for authentication.

A smart card reader is used to read the smart card and authenticate the user.

After you have authentication proving who or what an identity is, you can then use authorization, which allows a system to determine whether an authenticated user can access a resource and how they can access the resource.

A right authorizes a user to perform certain actions on a computer, such as logging on to a system interactively/locally to the computer, backing up files and directories, performing a system shutdown, or adding/removing a device driver. Administrators can assign specific rights to individual user accounts or group accounts. Rights are managed with the User Rights policy. For Windows Server 2008, you can find user rights by opening the group policy via the Group Policy Management console, opening Computer Configuration, opening Windows Settings, opening Security Settings, open- ing Local Policies, and opening User Rights Assignment.

CHAPTER 8: User Management

FIGURE 8.1 User rights.

A permission defines the type of access granted to an object or object attrib- ute. The permissions available for an object depend on the type of object. For example, a user has different permissions than a printer, which has different permissions than a file or folder on an NTFS volume. When a user or service tries to access an object, its access is granted or denied by an Object Manager. File and Folder permissions as well as Shared permissions are handled by Windows Explorer.