Welcome back to your free Windows 7 training series for the 70-680 exam. In this video
I will look at authentication and authorization in Windows 7. Authentication in Windows is
essentially proving you are who you say you are. Once Windows has established who you
are, you can then access resources on the network and the local computer.
Deciding what you have access to is called authorization. Authorization is basically
the process of deciding what you have access to once you have been authenticated. You can
see that to be authorized to access anything you first need to be authenticated.
Think of the process being like a security guard standing on the front gate of a film
studio. The actors are identified at the front gate and allowed access to their trailers
and the set. The workers are identified and allow access to the set. A general member
of the public is identified and sent on the free tour around the studio but not given
access to the set or trailers. In the computer world, the person needs to
be identified before they are given authorization to access anything. If they can’t be identified
they will be given anonymous access if it has been configured.
Windows has a number of different authentication systems that can use to identify who you are.
The first is Kerberos version 5. Kerberos is named after the three headed dog guarding
hades from Greek mythology. It is a ticket based system which can be used to authenticate
both users and computers. A ticket is mathematical time consuming to generate but can quickly
be verified to be authenticate once issued. Once a ticket has been issued, the ticket
can be used to provide access to anther system on the network. All the other system has to
do is check the ticket is valid which is a fast process when compared with generating
the ticket. Kerberos is the default system of authentication used in a domain environment.
For it to operate it requires a trust relationship to exist between the computer and the domain.
When you add a computer to a domain this trust relationship is created automatically.
Next there is NT Lan Manager or NTLM. As the name suggests, this authentication method
dates back to Windows NT. NTLM uses a challenge response authentication. The idea being that
if you are who you say you are you should be able to answer this. Generally speaking,
Windows will ask the other party a mathematical question that can only be answered by using
the password. This way the password does not need to be transferred over the network.
NTLM has been updated and improved since the Windows NT days, but you may wondering why
would you still need it when Kerberos is the default authentication system used in Windows.
Kerberos relies on a trust relationship between the domain and the computer. There are number
of cases when Kerberos can’t operate and NTLM is the next best option.
If the client computer is using an I P address to authenticate rather than the computer name
Kerberos can’t be used. Also if the computers are in different forests that do not have
a Kerberos compatible trust between them NTLM will be used.
If either of the computers is not in a domain Kerberos can’t be used and lastly if any
of the ports required for Kerberos are blocked by a firewall NTLM will be used.
The next kind of authentication that Windows supports is certificates. Certificates use
public and private keys in order to encrypt information travelling across the network.
With Windows server you can deploy a Microsoft Certificate authority or use a 3rd party certificate
authority. Windows 7 will support certificates generated from either.
One use of certificates is in smart cards. The smart card has a chip inside which holds
the certificate. The idea being that you can’t authenticate on the network without the smart
card. The problem with this approach is that if someone were to a steal a laptop with the
smart card still in it, they could access your network without needing a password. To
get around this problem, smart cards often support what is called multi factor identification.
Multi factor identification is when you require two or more authentication methods to access
the network. With smart cards this is usually a pin. If the laptop was stolen then the theft
would not have the pin and thus could not use the smart card to access the network.
Smartcards can also be used to encrypt hard disks and encrypt network traffic. They are
not limited to only to user authentication. The next type is biometrics. This includes
finger print readers and eye scanners often seen in the movies. Using biometrics the system
can’t identify the person from their physically characters.
This covers all the different way you can authenticate on Windows 7 or in simple terms
Windows can identify who you are. Once you are identified or authenticated the next stage
is authorization. Authorization put simply decides what you can access.
This is normally done through 3 different systems. Firstly you have permissions. Permissions
are assigned to a resource like a file and determine what the person can do. Common permissions
are read and write. Next you have polices. Polices are assigned
to a computer or user through group policy. They determine if something is available.
For example, if the user can access the control panel or change the wall paper.
Lastly you have rights. Rights are assigned to the computer. This determines what actions
the user can perform. An example of a right is being able to log on to the computer. You
either are allowed or you are not. Another example is the take ownership right assigned
to administrators. Regardless of what permissions are assigned to a file administers can take
ownership of that file. Why? Because administrators have the take ownership right assigned to
them by default. This may seem like a lot to know but Microsoft
has made it easier by creating built in groups. Built in groups have permissions, polices
and rights assigned to them by default. Microsoft has gone to a lot of work to create groups
that most users will fit into.
This list does not contain all the groups on a Windows 7 system. However this list does
cover the more commonly used by a network administrator. The first group is the administrators
group. This is the most powerful group on the system. End users should not be placed
in this group. Common practice on large networks is to login as the administrator when you
need to perform administrative tasks. When not performing administrative tasks then a
normal user account will work fine. The next group is the backup operators group.
Membership of this group can read any files on the system. The general idea is that users
in this group can perform backups and restore files. Users in this group can’t change
permissions on files or perform other administrative actions.
The next group is event log readers. Members of this group can read the event logs on the
computer. If you are using software to download logs from a remote system you could put the
users that requires access into this group. This prevents them from having access to other
parts of the system. The next group is network configuration operators.
Members of this group can make changes to network adapters and network connections.
It may seem strange having so many groups that don’t provide a lot of access but remember
that group membership is accumulatively. For example, a general user does not have access
to change network adapters on the computer. If you want to give them this ability, simply
add their user name to the network operators group. To give all users on that system the
ability to change network adapter settings add the users group to the network configuration
operators group. This gives you an easy solution to giving user more access without having
to make them administrators. The next group is the remote desktop users.
If you want to access your computer from remote using remote desktop you need to be a member
of this group. The exemption here is administrators. Administrators by default have access regardless
of whether they are in this group or not. If you want your users to be able to connect
via remote desktop to the computer you would normally add the users group or domain users
group to this group. The next group is the power users group. This
group was present in Windows XP and later removed in Windows Vista. In Windows 7 it
has returned for backward compatibility. It is recommended that you do not use this group.
If you do use this group, it is designed to give more rights than the user group but less
rights then the administrator so it falls somewhere in between.
The problem when adding general users to this group is that they also get access to certain
system files and settings which the general users should not have access to. In Windows
XP it was common practice to add users to this group in order to get software to work.
With Windows 7, I would try the other compatibility options to get your software to work and only
add the user to the power users group at a last resort.
The next group is the users group. This group is recommended for the average user. When
in this group the user can make changes to system settings that only affect them. They
can also only read system and program files. Users can not change settings that affect
the whole computer. It is recommended that the general user be put into this group.
The last group is the guests group. The guest group is usually only used on kiosk style
computers. Users in this group have limited rights which basically allow them to use resources
and run programs but not make any changes. This covers the basics of authorization and
authentication. I will now switch to my Windows 7 computer to demonstrate how authorization
and authentication works in Windows 7. The first feature I want to look at is the
credential manager. The credential manager allows you to save username and password in
a vault which saves you being prompted for them later. To open credential manger, first
open the control panel and then select user accounts and family safety. From here select
credential manger. To demonstrate how credential mangers works,
I will attempt to open a server on the network. You will notice that I am prompted for a username
and password. From the credential manger, if I select the option add Windows credential
I can add a username and password for this server.
Once the credential are added, if I now open the server again this time I won’t be asked
for a username and password. Using the credential manager you can also add user names and passwords
for later use. The user names and passwords you use in credentials manager can also be
backed up. If I now go back to user accounts and safety
and select user accounts, I can configure user accounts on this computer. On the far
left hand side you will notice the option create a password reset disk.
If you forget your password you can use this disk to get back into Windows. Once I select
the option a wizard will start in which I will need to select where to save the password
information. It is not safe to save the information on the hard disk so Windows gives you the
option to save only to the floppy disk drive or a thumb drive. Once you select your drive
the password information will be saved. This can later be used to reset your password if
you forget what it is. This covers the basics of authentication and
authorization. In the next video I will have a closer look at how certificates work in
Windows 7. For more free videos and free exam resources check out our web site or you tube
channel. Once again, thanks for watching.