Windows Security Settings

Question 1

Users - Windows Security Settings

Answer 1

• Administrator - The Windows super-user
• Guest - Limited access
• Standard Users - Everyone else

Question 2

Groups - Windows Security Settings

Answer 2

• Power Users - Not much more control than a regular user

Question 3

NTFS vs. Share permissions - Windows Security Settings

Answer 3

• NTFS permissions apply from local and network connections
• Share permissions only apply to connections over the network
• The most restrictive setting wins - Deny beats allow
• NTFS permissions are inherited from the parent object
  
  • Unless you move to a different folder on the same volume

Question 4

Shared files and folders - Windows Security Settings

Answer 4

• Administrative shares
• Hidden shares (i.e., C$) created during installation
• Local shares are created by users
• System files and folders
  
  • C$ - \
  • ADMIN$ - \Windows
  • PRINT$ - Printers folder
• Computer Management / Shared Folders - net share

Question 5

Explicit and inherited permissions - Windows Security Settings

Answer 5

• Explicit permissions - Set default permissions for a share
• Inherited permissions
  
  • Propagated from the parent object to the child object
  • Set a permission once, it applies to everything underneath
• Explicit permissions take precedence over inherited permissions
  
  • Even inherited deny permissions

Question 6

User authentication - Windows Security Settings

Answer 6

• Authentication - Prove you are the valid account holder
  
  • Username / Password - Perhaps additional credentials
• Single sign-on (SSO), i.e., Windows Domain
  
  • Provide credentials one time, managed through Kerberos

Question 7

Run as administrator - Windows Security Settings

Answer 7

• Administrators have special rights and permissions
• Use rights and permissions of the administrator
  
  • You don’t get these by default, even if you’re in the Administrators group
• Right-click the application, Run as administrator
  
  • Or Ctrl-Shift -Enter

Question 8

Bitlocker - Windows Security Settings

Answer 8

• Encrypt an entire volume - Not just a single file
  
  • Protects all of your data, including the OS
• Lose your laptop? Doesn’t matter without the password
• Data is always protected
  
  • Even if the physical drive is moved to another computer
• BitLocker To Go - Encrypt removable USB flash drives

Question 9

EFS (Encrypting File System) - Windows Security Settings

Answer 9

• Encrypt at the filesystem level on NTFS
• OS support:
  
  • Vista Business, Enterprise and Ultimate
  • 7 Professional, Enterprise and Ultimate
  • 8 and 8.1 Pro and Enterprise
• Uses password and username to encrypt the key
• Administrative resets will cause EFS files to be inaccessible