Users and groups on Windows¶

Exercise users-and-groups-on-windows-annex.pdf · PDF

Think of the computer at home. When you switch it on, whose account opens? Yours, or "the family's"? And can your little brother install any game he finds on it?

On most home PCs there is one account, it can do everything, and everybody uses it. That is exactly how a lot of malware gets in. In Users and groups on Linux you met UIDs, root and the group sudo. Today you meet the same ideas on Windows — with other names, other tools, and one clever trick called UAC.

The same ideas, other names¶

On Linux the truth about users lives in text files, and tools edit them. On Windows the truth lives in a database, and you only ever see it through a tool. Different house, same furniture:

A SID (security identifier) is the number Windows really uses to identify an account. The name is only a label for humans.

Two kinds of account¶

• A local account exists only inside this PC, like the Linux users you created in deb-lab.
• A Microsoft account is an online identity (an e-mail address) that Windows can use to sign in. Windows 11 pushes it hard during installation.

In this unit you use local accounts only. Company PCs use a third kind, domain accounts, which you will meet in Unit 6.

Three toolboxes¶

The same job can be done in three places. Not every edition of Windows has all of them:

To know which edition you have, press Win+R and type winver.

Users and groups with the mouse¶

In your win11 VM, the Exercise sheet walks you through it. The key moments:

1. Settings → Accounts → Other users → Add account. Windows offers a Microsoft account. Look for the small print: I don't have this person's sign-in information, then Add a user without a Microsoft account. Create marta. She appears as Local account, a standard user.
2. Win+R → lusrmgr.msc (not on Home). Users → New User… creates joan. Groups → New Group… creates dev with marta, and design with joan.
3. Open marta → Properties → Member Of: she is in Users and dev.
4. Open C:\Users in File Explorer. There is no folder marta yet. Windows builds the profile the first time she signs in.

UAC: an administrator who is not one¶

A little history¶

Windows XP (2001): the account created at installation was an administrator, and so was every program it started — the browser, the game, the attachment someone double-clicked. One wrong click and the malware owned the machine. It happened millions of times.

With Windows Vista (2007) Microsoft added User Account Control, or UAC. People hated its constant questions; Windows 7 made it quieter; it has been there ever since.

Two key rings¶

An access token is the list of identities and rights that a program carries with it.

Picture an administrator who arrives with two key rings. One has the everyday keys. The other has the master keys, and it stays in the pocket.

• When a member of Administrators signs in, Windows gives them two access tokens: a standard one and an administrator one.
• The desktop, and everything you start from it, gets the standard token. So an administrator's browser runs with a standard user's rights.
• When a program needs more, Windows asks first. That question is the elevation prompt. It appears on the secure desktop: the screen goes dim and only Windows itself can click there, so no program can press "Yes" for you.

flowchart LR
    SIGN["<b>Sign-in</b><br>member of Administrators"] --> STD["<b>Standard token</b><br>the everyday key ring"]
    SIGN --> ADM["<b>Administrator token</b><br>the master keys, kept in the pocket"]
    STD -->|"every program starts here"| APP["Browser, Terminal, games"]
    APP -->|"needs more rights"| UAC["<b>UAC prompt</b><br>on the secure desktop"]
    UAC -->|"Yes"| ADM

There are two kinds of prompt, and which one you see depends on who you are:

A small shield icon on a button or a menu entry means "this will ask for elevation".

See it with your own eyes¶

Open Terminal the normal way and try to create a user:

net user test1 /add

System error 5 has occurred.

Access is denied.

Now ask Windows which groups you carry:

whoami /groups

In the line BUILTIN\Administrators the attributes say Group used for deny only, and the last line says Medium Mandatory Level. You are in the group, but this window is not using it.

Right-click Start → Terminal (Admin). The screen dims and the consent prompt asks Yes / No. Run whoami /groups in the new window: Administrators is now an Enabled group, and the level is High Mandatory Level. That is the second key ring.

Sign in as marta and try the same: a standard user gets the credential prompt, asking for an administrator's password.

The recommended way to use Windows, in Microsoft's own documentation, is to work every day as a standard user and type an administrator's password only when needed. It is the same rule you learnt on Linux: be student, borrow root for one command.

The same job with commands¶

Twelve employees are fine with the mouse. Twelve hundred are not. Every row below does the same job with the old net command (it works in CMD and PowerShell) and with the PowerShell cmdlets. Run them in Terminal (Admin):

Two details matter:

• The * in net user aina * /add makes Windows ask for the password without showing it. Writing the password inside the command would leave it in the history.
• PowerShell does not accept a password as plain text. First read it as a secure string, then use it:

$pw = Read-Host -AsSecureString "Password"
New-LocalUser -Name pau -Password $pw -FullName "Pau (intern)"

Add-LocalGroupMember -Group Users -Member pau
Add-LocalGroupMember -Group dev -Member pau
Get-LocalGroupMember -Group dev

Reading the SIDs¶

Get-LocalUser | Select-Object Name, Enabled, SID

• Administrator ends in -500 and Enabled is False. Guest ends in -501.
• The users you created end in numbers above 1000 — like Linux UIDs.
• All of them start with the same S-1-5-21-…: that part identifies this PC.

Disable or delete?¶

Aina goes on leave. You do not delete her; you disable her:

Disable-LocalUser -Name aina
Get-LocalUser aina
Enable-LocalUser -Name aina

Key takeaways¶

• Windows identifies accounts by their SID, like Linux uses the UID. Accounts live in the SAM database, not in text files.
• A local account lives only on this PC; a Microsoft account is an online identity. The built-in Administrator (-500) is disabled; your account is a member of the group Administrators.
• UAC gives an administrator two access tokens. Programs start with the standard one; elevation asks first: consent prompt for administrators, credential prompt for standard users.
• The same jobs can be done in Settings, lusrmgr.msc (not on Home), net user / net localgroup, and PowerShell cmdlets like New-LocalUser.
• New-LocalUser adds the user to no group: add them to Users yourself. Disabling keeps the SID; deleting loses it for good.

Quick check¶

Now you know who can sign in and who can become an administrator. Next: how the system protects the passwords themselves, and how to force good ones — account and password policies.