2.5 - Windows Security Settings

Question 1

Windows authentication

Answer 1

• Login to the Windows desktop
  – And access network resources
• Local accounts
  – Only associated with a specific Windows device
• Microsoft accounts
  – Sync settings between devices, integrate applications
  (Skype, Office) with OneDrive, and more
• Windows Domain accounts
  – Centrally managed from Active Directory

Question 2

Users and groups

Answer 2

• Users
  – Administrator
  – The Windows super-user
  – Guest (Limited access)
  – Standard Users
• Groups
  – Power Users
  – Not much more control than a regular user
  – Permissions removed in Windows Vista and later

Question 3

Login options

Answer 3

• Username / password
  – Common authentication credentials
• Personal Identification Number (PIN)
  – A local access code
• Biometrics
  – Fingerprint, facial recognition
• Single sign-on (SSO)
  – Windows Domain credentials
  – Sign in one time

Question 4

NTFS vs. Share permissions

Answer 4

• NTFS permissions apply from local and
  network connections
• Share permissions only apply to connections
  over the network
  – A “network share”
• The most restrictive setting wins
  – Deny beats allow
• NTFS permissions are inherited from
  the parent object
  – Unless you move to a different folder
  on the same volume

Question 5

Explicit and inherited permissions

Answer 5

• Explicit permissions
  – Set default permissions for a share
• Inherited permissions
  – Propagated from the parent object to
  the child object
  – Set a permission once, it applies to
  everything underneath
• Explicit permissions take precedence over
  inherited permissions
  – Even inherited deny permissions

Question 6

Run as administrator

Answer 6

• Administrators have special rights and permissions
  – Editing system files, installing services
• Use rights and permissions of the administrator
  – You don’t get these by default, even if you’re in
  the Administrators group
• Right-click the application
  – Run as administrator
  – Or search and click “Run as administrator”

Question 7

UAC (User Account Control)

Answer 7

• Limit software access - Protect your computer
• Standard users
  – Use the network or change your password
• Administrators
  – Install applications or configure Remote Desktop
• Secure Desktop - Limits automated access

Question 8

BitLocker

Answer 8

• Encrypt an entire volume
  – Protects all of your data, including the OS
  – Support for all Windows editions except Home
• Lose your laptop? - Doesn’t matter without the password
• Data is always protected
  – Even if the physical drive is moved to another computer
• BitLocker To Go - Encrypt removable USB flash drives

Question 9

EFS

Answer 9

• Encrypting File System
  – Encrypt at the file system level
  – Requires the NTFS file system
• OS support
  – Support for all Windows editions except Home
• Uses password and username to encrypt the key
  – Administrative resets will cause EFS files to be
  inaccessible