Contents for User Manager for Domains Help

Introduction

 User Manager for Domains Overview

How To...

 Manage the View

 Manage User Accounts

 Manage Global Groups

 Manage Local Groups

 Manage the Security Policies

Commands

 User Menu Commands

 View Menu Commands

 Policies Menu Commands

 Options Menu Commands


Contents-All User Manager Topics
Contents for User Manager for Domains Help

Introduction

 User Manager for Domains Overview

 What Is User Manager for Domains?

 The User Manager for Domains Window

 What Are the Security Policies?

How To...

 Manage the View

 Selecting a Domain

 Sorting the User Account List

 Refreshing the View

 Using Low Speed Connection

 Manage User Accounts

 Creating a New User Account

 Copying a User Account

 Managing Properties for One User Account

 Managing Properties for Multiple User Accounts

 Managing Group Memberships for One User Account

 Managing Group Memberships for Multiple User Accounts

 Managing Profiles

 Managing Logon Hours

 Managing Logon Workstations

 Managing Account Information

 Disabling User Accounts

 Deleting User Accounts

 Renaming User Accounts

 Selecting User Accounts

 Manage Global Groups

 Creating a New Global Group

 Copying a Global Group

 Managing Global Group Properties

 Deleting a Global Group

 Manage Local Groups

 Creating a New Local Group

 Copying a Local Group

 Managing Local Group Properties

 Deleting a Local Group

 Manage the Security Policies

 Managing the Account Policy

 Managing the User Rights Policy

 Managing the Audit Policy

 Permitting Another Domain to Trust

 Trusting Another Domain

Commands

 User Menu Commands

 New User

 New Global Group

 New Local Group

 Copy

 Delete

 Rename

 Properties

 Select Users

 Select Domain

 Exit

 View Menu Commands

 Sort by Full Name

 Sort by Username

 Refresh

 Policies Menu Commands

 Account

 User Rights

 Audit

 Trust Relationships

 Options Menu Commands

 Low Speed Connection

 Confirmation

 Save Settings on Exit

 Font


Contents for User Manager for Domains Help

Introduction

 User Manager for Domains Overview

 What Is User Manager for Domains?

 The User Manager for Domains Window

 What Are the Security Policies?

How To...

 Manage the View

 Manage User Accounts

 Manage Global Groups

 Manage Local Groups

 Manage the Security Policies

Commands

 User Menu Commands

 View Menu Commands

 Policies Menu Commands

 Options Menu Commands


Contents for User Manager for Domains Help

Introduction

 User Manager for Domains Overview

How To...

 Manage the View

 Selecting a Domain

 Sorting the User Account List

 Refreshing the View

 Using Low Speed Connection

 Manage User Accounts

 Manage Global Groups

 Manage Local Groups

 Manage the Security Policies

Commands

 User Menu Commands

 View Menu Commands

 Policies Menu Commands

 Options Menu Commands


Contents for User Manager for Domains Help

Introduction

 User Manager for Domains Overview

How To...

 Manage the View

 Manage User Accounts

 Creating a New User Account

 Copying a User Account

 Managing Properties for One User Account

 Managing Properties for Multiple User Accounts

 Managing Group Memberships for One User Account

 Managing Group Memberships for Multiple User Accounts

 Managing Profiles

 Managing Logon Hours

 Managing Logon Workstations

 Managing Account Information

 Disabling User Accounts

 Deleting User Accounts

 Renaming User Accounts

 Selecting User Accounts

 Manage Global Groups

 Manage Local Groups

 Manage the Security Policies

Commands

 User Menu Commands

 View Menu Commands

 Policies Menu Commands

 Options Menu Commands


Contents for User Manager for Domains Help

Introduction

 User Manager for Domains Overview

How To...

 Manage the View

 Manage User Accounts

 Manage Global Groups

 Creating a New Global Group

 Copying a Global Group

 Managing Global Group Properties

 Deleting a Global Group

 Manage Local Groups

 Manage the Security Policies

Commands

 User Menu Commands

 View Menu Commands

 Policies Menu Commands

 Options Menu Commands


Contents for User Manager for Domains Help

Introduction

 User Manager for Domains Overview

How To...

 Manage the View

 Manage User Accounts

 Manage Global Groups

 Manage Local Groups

 Creating a New Local Group

 Copying a Local Group

 Managing Local Group Properties

 Deleting a Local Group

 Manage the Security Policies

Commands

 User Menu Commands

 View Menu Commands

 Policies Menu Commands

 Options Menu Commands


Contents for User Manager for Domains Help

Introduction

 User Manager for Domains Overview

How To...

 Manage the View

 Manage User Accounts

 Manage Global Groups

 Manage Local Groups

 Manage the Security Policies

 Managing the Account Policy

 Managing the User Rights Policy

 Managing the Audit Policy

 Permitting Another Domain to Trust

 Trusting Another Domain

Commands

 User Menu Commands

 View Menu Commands

 Policies Menu Commands

 Options Menu Commands


Contents for User Manager for Domains Help

Introduction

 User Manager for Domains Overview

How To...

 Manage the View

 Manage User Accounts

 Manage Global Groups

 Manage Local Groups

 Manage the Security Policies

Commands

 User Menu Commands

 New User

 New Global Group

 New Local Group

 Copy

 Delete

 Rename

 Properties

 Select Users

 Select Domain

 Exit

 View Menu Commands

 Policies Menu Commands

 Options Menu Commands


New User command
New User

Choose this command to create one or more new user accounts.

See Also

Creating a New User Account


New Global Group command
New Global Group

Choose this command to create a new global group.

Note:  This command is unavailable when Low Speed Connection is selected, or when you are administering a Windows NT Workstation computer or a Windows NT Server computer that is not configured as a primary or backup domain controller.

See Also

Creating a New Global Group

Using Low Speed Connection


New Local Group command
New Local Group

Choose this command to create a new local group.

See Also

Creating a New Local Group


Copy command
Copy

Choose this command to create one or more new user accounts or one new group, copied from an existing user account or group that you have selected in the User Manager for Domains window.

See Also

Copying a User Account

Copying a Global Group

Copying a Local Group

Using Low Speed Connection


Delete command
Delete

Choose this command to delete one or more user accounts, or one local group, that you have selected in the User Manager for Domains window.  User accounts and groups that have been created using User Manager for Domains can be deleted, but the built-in user accounts and groups cannot.

Be certain you want to delete a group or user account before you do so, because they cannot be recovered. Internally, Windows NT knows every group and user account by its security identifier (SID), a unique number that identifies it. If you delete a group or user account and then create another with the same name, the new one will not have any of the rights or permissions that were previously granted to the old one, because they have different SID numbers.

See Also

Disabling User Accounts

Deleting User Accounts

Deleting a Global Group

Deleting a Local Group

Using Low Speed Connection


Rename command
Rename

Choose this command to rename a selected user account.

See Also

Renaming User Accounts

Using Low Speed Connection


Properties command
Properties

Choose this command to modify one or more user accounts, or one group, that you have selected in the User Manager for Domains window.

See Also

Managing Properties for One User Account

Managing Properties for Multiple User Accounts

Managing Global Group Properties

Managing Local Group Properties

Using Low Speed Connection


Select Users command
Select Users

Displays a dialog box from which you can select a group, and then quickly and easily select or deselect all the user accounts that are members of that group.

After the user accounts are selected, you can modify the properties of all those accounts in the same way, delete all those accounts, or create a new group containing those accounts.

This command is unavailable when Low Speed Connection is selected.

See Also

Selecting User Accounts

Using Low Speed Connection


Select Domain command
Select Domain

When User Manager for Domains starts, it displays the domain where your user account is defined.  Use the Select Domain command to display a different domain.

Optionally, use the Select Domain command to display an individual computer.  However, you can only display a computer that maintains its own security database, such as a Windows NT Workstation computer, a Windows NT Server computer that is not a domain controller, or a Microsoft LAN Manager server.

See Also

Selecting a Domain

Using Low Speed Connection


Exit command
Exit

Quits User Manager for Domains.


Contents for User Manager for Domains Help

Introduction

 User Manager for Domains Overview

How To...

 Manage the View

 Manage User Accounts

 Manage Global Groups

 Manage Local Groups

 Manage the Security Policies

Commands

 User Menu Commands

 View Menu Commands

 Sort by Full Name

 Sort by Username

 Refresh

 Policies Menu Commands

 Options Menu Commands


Sort by Full Name command
Sort by Full Name

Sorts the displayed user accounts by the full names.  When Sort by Full Name is enabled, a check appears on the menu to the left of the command.

This command is unavailable when Low Speed Connection is selected.

See Also

Sorting the User Account List


Sort by Username command
Sort by Username

Sorts the displayed user accounts by the user names.  When Sort by Username is enabled, a check appears on the menu next to the command.

This command is unavailable when Low Speed Connection is selected.

See Also

Sorting the User Account List


Refresh command
Refresh

Updates the display with current information.

This command is unavailable when Low Speed Connection is selected.

See Also

Refreshing the View

Using Low Speed Connection


Contents for User Manager for Domains Help

Introduction

 User Manager for Domains Overview

How To...

 Manage the View

 Manage User Accounts

 Manage Global Groups

 Manage Local Groups

 Manage the Security Policies

Commands

 User Menu Commands

 View Menu Commands

 Policies Menu Commands

 Account

 User Rights

 Audit

 Trust Relationships

 Options Menu Commands


Account command
Account

The Account policy controls how passwords must be used by all user accounts.  It defines such things as the maximum password age, minimum password age, minimum password length, and whether or not a password history is maintained.

The Account policy determines whether all user accounts are subject to lockout. If lockout is enabled, then a user account becomes locked if there are a number of incorrect attempts to log on to that account, occurring with no more than a specified amount of time between any two of the bad logon atttempts. A locked account remains locked until an administrator unlocks it or a specified amount of time passes. Locked accounts cannot log on.

The Account policy also determines whether or not a remote user will be forcibly disconnected from all connections to servers in the domain if that user's logon hours expire.

See Also

Managing the Account Policy


User Rights command
User Rights

The User Rights policy manages the rights granted to groups and user accounts.

A right authorizes a user to perform certain actions on the system. A user who logs on to an account to which the appropriate rights have been granted can carry out the corresponding actions. When a user does not have appropriate rights, Windows NT blocks attempts to carry out those actions.  Rights apply to the system as a whole and are different from permissions, which apply to specific objects.

The rights granted to a group are provided to the members of that group.  In most situations, the easiest way to provide rights to a user is to add that user's account to one of the built-in groups that already possesses the needed rights, rather than by administering the User Rights policy.

See Also

Managing the User Rights Policy

The User Rights


Audit command
Audit

Windows NT can track selected activities of users, by auditing security events and then placing entries in a computer's security log.  Windows NT can record a range of security event types, from a system-wide event such as a user logging on, to an attempt by a user to read a specific file. Both successful and unsuccessful attempts to perform an action can be recorded.

Use the Audit policy to determine the types of security events Windows NT will log.  When administering domains, the Audit policy affects the security logs of the domain controller and of all servers in the domain, because they share the same Audit policy. When administering a Windows NT Workstation computer or a Windows NT Server computer that is not a domain controller, this policy affects the security log of that computer only.

Entries in a security log can be reviewed using Event Viewer.

See Also

Managing the Audit Policy


Trust Relationships command
Trust Relationships

The Trust Relationships policy is used to specify the domains that this domain trusts, and the domains that are allowed to trust this domain.

A trust relationship is a link between two Windows NT Server domains, where one domain honors the users of another domain, trusting the logon authentications performed by that other domain for its own users.  User accounts and global groups defined in a trusted domain can be granted rights, resource permissions, and local group memberships at a trusting domain and its member computers, even though those accounts don't exist in the trusting domain's security database.

When trust relationships are properly established between all the domains of a network, they allow a user to have only one user account and one password in one domain, yet to access the entire network.  Trust relationships move the convenience of centralized administration from the domain level to the network level.

Because trust relationships can only be established between Windows NT Server domains, the Trust Relationships command is unavailable when an individual computer (such as a Windows NT Workstation computer) or another type of domain (such as a LAN Manager domain) is being administered.

See Also

Permitting Another Domain to Trust

Trusting Another Domain


Contents for User Manager for Domains Help

Introduction

 User Manager for Domains Overview

How To...

 Manage the View

 Manage User Accounts

 Manage Global Groups

 Manage Local Groups

 Manage the Security Policies

Commands

 User Menu Commands

 View Menu Commands

 Policies Menu Commands

 Options Menu Commands

 Low Speed Connection

 Confirmation

 Save Settings on Exit

 Font


Low Speed Connection command
Low Speed Connection

When administering a domain or computer that communicates with your computer across a connection providing relatively low transmission rates, some User Manager for Domains functions may be performed slowly.  In this situation, you can reduce delays by choosing Low Speed Connection from the Options menu.  Choosing Low Speed Connection prevents the lists of users and groups from being displayed, but still allows you to administer users and local groups (but not global groups).

The same option can also be selected (or cleared) from the Select Domain dialog box, at the same time you specify a domain or computer to be displayed by User Manager for Domains.

See Also

Using Low Speed Connection

Selecting a Domain


Confirmation command
Confirmation

Causes a message to appear asking for confirmation, after you issue certain commands.

When Confirmation is enabled, a check appears on the menu to the left of the command.


Save Settings on Exit command
Save Settings on Exit

Saves these settings when you quit User Manager for Domains:  Main window size and position, sort order (sort by user name or full name), and the setting for the Options menu Confirmation command.

When Save Settings is enabled, a check appears on the menu to the left of the command.


Font command
Font

Enables you to change the font used for the list of users and groups in the User Manager for Domains main window.


Contents command
Contents

Lists User Manager for Domains Help topics.


Search For Help On command
Search for Help On

Presents an index of keywords from User Manager for Domains Help.  Associated Help topics can be listed, selected, and opened.


How to Use Help command
How to Use Help

Provides introductory information about accessing and using the online Help system.


About User Manager command
About User Manager

Provides the version number, serial number, copyright, licensing, and other information about Microsoft Windows NT User Manager for Domains.


What Is User Manager for Domains?

User Manager for Domains is a tool you can use to manage security for domains, servers, and workstations. With User Manager for Domains you can:

Select the domain or computer to be administered.

Create and manage user accounts.

Create and manage groups.

Manage the security policies.

See Also

The User Manager for Domains Window


The User Manager for Domains Window

In most cases, when User Manager for Domains first starts, it displays your logon domain.  The title bar shows the domain name, and the body of the User Manager for Domains window displays two lists.  The upper list contains user accounts; the lower list contains groups.  One or more user accounts, or one group, can be selected and then managed using commands from the User menu.

Choose one of the following buttons for more information about the User Manager for Domains window.

 Title bar

 Menu bar

 List of users

 User icon

 Username

 Full Name

 Description (of users)

 List of groups

 Group icon

 Groups

 Description (of groups)

See Also

Using Low Speed Connection


Title bar

The title bar names the domain or computer that is displayed for administration.


Menu bar

The menu bar contains five menus.

User.  Commands from this menu are used to create and manage user accounts and groups, and to select the domain or computer to be administered.

View.  Commands from this menu are used to sort the user account list either by user name or by full name, and to update User Manager with current information.

Policies.  Commands from this menu are used to manage the security policies.

Options.  Commands from this menu can select or clear the Low Speed Connection, Confirmation, and Save Settings on Exit options.

Help.  Commands from this menu provide online Help.


List of users

The upper half of the window lists the user accounts of the domain selected for administration (meaning the domain whose name appears in the title bar).  The list contains both the built-in user accounts provided with the system, and any user accounts that have been added by using User Manager for Domains.

When you have selected an individual Windows NT Workstation computer or a Windows NT Server computer that is not a domain controller, the list contains the user accounts of that computer.


User icon

An icon graphically indicates the type of each listed user account.

Global account.  This is a normal user account in a user's home domain.  Most accounts are global accounts.  When trust relationships are established between domains, each network user only needs to have one global account in one domain, yet can be granted access to any trusting domain.

Local account.  This is an account provided in this domain as a special accommodation for a user whose global account is in a domain that does not have a trust relationship with this domain.

When an individual Windows NT Workstation computer is selected for administration, the list contains only global accounts, because Windows NT Workstation computers do not maintain local accounts.


Username

For each listed user account, this column contains a user name, which is used by Windows NT to identify the account.  A user name is always unique, meaning it cannot be identical to any other user or group name of the domain or computer being administered.

The user names might be displayed in either the first or second column of the user account list.  This sort order is controlled by commands which can be chosen from the View menu.


Full Name

For each listed user account, this column might contain the user's full name or it might be blank.  (When a user account is created or modified, the full name is an optional entry.)

The full names might be displayed in either the first or second column of the user account list.  This sort order is controlled by commands from the View menu.


Description (of users)

For each listed user account, this column might contain descriptive text or it might be blank.

(When a user account is created or modified, the description is an optional entry.)


List of groups

The lower half of the window lists the groups of the domain selected for administration (meaning the domain whose name appears in the title bar).  The list contains local and global groups, including both the built-in groups provided with the system, and any groups that have been added by using User Manager for Domains.

When you have selected an individual Windows NT Workstation computer or a Windows NT Server computer that is not a domain controller, the list contains only local groups, because these computers do not maintain global groups.


Group icon

An icon graphically indicates the type of each listed group.

Local group.  This type of group can only be granted permissions and rights for the servers of its own domain. However, it can contain user accounts and global groups both from its own domain and from trusted domains.

Global group.  This type of group can be granted permissions and rights for the servers of its own domain, workstations of its own domain, and for trusting domains. In all those places it can become a member of local groups. However, it can contain only user accounts from its own domain.

When you have selected an individual Windows NT Workstation computer or a Windows NT Server computer that is not a domain controller, the list contains only local groups, because these computers do not maintain global groups.


Groups

For each listed group, this column contains a group name, which is used by Windows NT to identify the group.  A group name is always unique, meaning it cannot be identical to any other group or user name of the domain or computer being administered.


Description (of groups)

For each listed group, this column might contain descriptive text or it might be blank.

(When a group is created or modified, the description is an optional entry.)


What Are the Security Policies?

Choose one of the following buttons for summary information about the security policies.

 Account policy

 User Rights policy

 Audit policy

 Trust Relationships


Account policy

The Account policy controls how passwords must be used by all user accounts.  It defines such things as the maximum password age, minimum password age, minimum password length, and whether or not a password history is maintained.

The Account policy determines whether all user accounts are subject to lockout. If lockout is enabled, then a user account becomes locked if there are a number of incorrect attempts to log on to that account, occurring with no more than a specified amount of time between any two of the bad logon atttempts. A locked account remains locked until an administrator unlocks it or a specified amount of time passes. Locked accounts cannot log on.

The Account policy also determines whether or not a remote user will be forcibly disconnected from all connections to servers in the domain if that user's logon hours expire, and whether users must log on before changing their passwords.


User Rights policy

The User Rights policy manages the rights granted to groups and user accounts.

A right authorizes a user to perform certain actions on the system. A user who logs on to an account to which the appropriate rights have been granted can carry out the corresponding actions. When a user does not have appropriate rights, Windows NT blocks attempts to carry out those actions.  Rights apply to the system as a whole and are different from permissions, which apply to specific objects.

The rights granted to a group are provided to the members of that group.  In most situations, the easiest way to provide rights to a user is to add that user's account to one of the built-in groups that already possesses the needed rights, rather than by administering the User Rights policy.


Audit policy

Windows NT can track selected activities of users, by auditing security events and then placing entries in a computer's security log.  Windows NT can record a range of security event types, from a system-wide event such as a user logging on, to an attempt by a user to read a specific file. Both successful and unsuccessful attempts to perform an action can be recorded.

Use the Audit policy to determine the types of security events Windows NT will log.  When administering domains, the Audit policy affects the security logs of the domain controller and of all servers in the domain, because they share the same Audit policy. When administering a Windows NT Workstation computer or a Windows NT Server computer that is not a domain controller, this policy affects only the security log of that computer.

Entries in a security log can be reviewed using Event Viewer.


Trust Relationships

Trust Relationships specify the domains that this domain trusts, and the domains that are allowed to trust this domain.

A trust relationship is a link between two domains, where one domain honors the users of another domain, trusting that other domain to authenticate the logons of its own users. When trust relationships are properly established between the domains of a network, they allow a user to have only one user account in one domain, yet to access the entire network. All the computers on the network can recognize the user account, requiring a user to log on and provide a password only once to access any computer on the network.

Trust relationships move the convenience of centralized administration from the domain level to to the network level.


Selecting a Domain

When it first starts, User Manager for Domains displays the domain where your user account is defined.  A different domain can be selected.

To change the displayed domain

1.	From the User menu, choose Select Domain.

2.	Choose a domain from the list in the Select Domain box, or type a domainname in the Domain box.

Optionally, you can display an individual computer by providing the \\computername (precede computer names with two backslashes) in place of the domainname.  You can only display a computer that maintains its own security database, such as a Windows NT workstation.

3.	If the domain or computer you have specified communicates with your computer over a low speed connection, select the Low Speed Connection option.

The system saves the setting of this option for each of the last 20 domains or computers you have administered.  After you specify a domain or computer name, the previous setting of this option (if any) is initially displayed here.  If no previous setting is known, the option is initially cleared.  You can accept or change the setting.

4.	Choose the OK button.

See Also

Using Low Speed Connection


Sorting the User Account List

The user account list in the upper half of the User Manager for Domains window is sorted alphabetically by either the full names or user names of the user accounts.

To change the sort order

From the View menu, choose either Sort By Full Name or Sort By Username.

Note:	When Low Speed Connection is selected, the Sort By Full Name and Sort By Username commands are unavailable.


Refreshing the View

When User Manager for Domains first displays a domain or a computer, it obtains the information shown in the User Manager for Domains window.  This information is automatically updated at fixed intervals.  However, if you want to make sure the displayed information is current, you can use the Refresh command.

To update the view with current information

From the View menu, choose Refresh.

Note:	When Low Speed Connection is selected, the Refresh command is unavailable.


Using Low Speed Connection

When administering a domain or computer that communicates with your computer across a connection providing relatively low transmission rates, some User Manager for Domains functions may be performed slowly.  This particularly affects the speed at which lists of user accounts, groups, or computers can be produced and displayed.  In this situation, you can reduce delays by selecting Low Speed Connection, which causes the following changes to User Manager for Domains:

The list of user accounts does not appear in the User Manager for Domains window, and on the User menu the Select Users command is unavailable.  However, user accounts can still be created or managed by choosing the New User, Copy, Delete, Rename, or Properties command from the User menu.

The list of groups does not appear in the User Manager for Domains window.  Local groups can still be created and managed by choosing the New Local Group, Copy, Delete, or Properties command from the User menu.

Global groups cannot be created or copied, properties of existing global groups cannot be managed, and on the User menu the New Global Group command is unavailable.  However, global group memberships can still be managed indirectly, by managing the group memberships of individual user accounts.

The View menu commands (Sort By Full Name, Sort By Username, and Refresh) are unavailable.

Here are two ways to select or clear Low Speed Connection:

When you have chosen the Select Domain command from the User menu and you are specifying a domain or computer that will be displayed by User Manager for Domains, in the Select Domain dialog box you can select or clear the Low Speed Connection option.

When a domain or computer is already displayed by User Manager for Domains, you can select or clear this option by choosing Low Speed Connection from the Options menu.

The system saves the setting of the Low Speed Connection option for each of the last 20 domains or computers you have administered.  After you specify a domain or computer name in the Select Domain dialog box, the previous state of this option (if any) will be initially set.  You can accept or change this setting.

If you have not previously administered the specified domain or computer, and if you do not select the Low Speed Connection option in the Select Domain dialog box, after you choose the OK button the system automatically determines the appropriate connection mode and selects or clears the Low Speed Connection option accordingly.  After connection, you still have the option of changing the setting by using the Low Speed Connection command from the Options menu.

Also, when starting User Manager for Domains from the command prompt you can optionally append the low speed connection parameter [/l] or the normal (high speed) connection parameter [/h].  For example, to start User Manager for Domains and administer a domain named Shipping using Low Speed Connection, you would type usrmgr shipping /l.

See Also

Selecting a Domain


Creating a New User Account

To create a new user account

1.	From the User menu, choose New User.

2.	In the Username box, type a user name of up to 20 characters.  A user name cannot be identical to any other user or group name of the domain or computer being administered.  It can contain any uppercase or lowercase characters except for the following:

"  /  \  [  ]  :  ;  |  =  ,  +  *  ?  <  >

3.	In the Full Name box, type the user's complete name.

4.	In the Description box, type a description of the user or the user account.

5.	In both the Password and Confirm Password boxes, type a password of up to 14 characters.

Remember, passwords are case sensitive.  (Windows NT distinguishes between uppercase and lowercase characters in passwords.)

6.	Select or clear the Account Disabled option, and the password options.

7.	To administer a property associated with one of the buttons at the bottom of the User Properties dialog box, choose one of those buttons and complete the dialog box that appears.

When administering a domain, there are five buttons: Groups, Profile, Hours, Logon From, and Account.  When administering a workstation, only the Groups and Profile buttons are appear.

8.	Choose the Add button.

The user account is added and the New User dialog box reverts to its default settings.

9.	To add another user account, repeat steps 2 through 8.  When you finish creating new user accounts, choose the Close button.

See Also

Managing Group Memberships for One User Account

Managing Profiles

Managing Logon Hours

Managing Logon Workstations

Managing Account Information

Using Low Speed Connection


Copying a User Account

In many situations, it may be quicker and more convenient to copy an existing user account than it would be to create an entirely new one.  One major benefit of copying a user account is that group memberships are copied to the new account.

To copy a user account

1.	In the User Manager for Domains window, select a user account.

2.	From the User menu, choose Copy.

3.	In the Username box, type a user name of up to 20 characters.  A user name cannot be identical to any other user or group name of the domain or computer being administered.  It can contain any uppercase or lowercase characters except for the following:

"  /  \  [  ]  :  ;  |  =  ,  +  *  ?  <  >

4.	In the Full Name box, type the user's complete name.

5.	Optionally, to change the description, type new text in the Description box.

6.	In both the Password and Confirm Password boxes, type a password of up to 14 characters.

Remember, passwords are case sensitive.  (Windows NT distinguishes between uppercase and lowercase characters in passwords.)

7.	Select or clear the Account Disabled option, and the password options.

8.	To administer a property associated with one of the buttons at the bottom of the User Properties dialog box, choose one of those buttons and complete the dialog box that appears.

When administering a domain, there are five buttons: Groups, Profile, Hours, Logon From, and Account.  When administering a workstation, only the Groups and Profile buttons are appear.

9.	Choose the Add button.

The user account is added.  The Copy Of dialog box reverts to its original settings.

10.	To add another user account, repeat steps 3 through 9.  When you finish creating copies of the selected account, choose the Close button.

See Also

Managing Group Memberships for One User Account

Managing Profiles

Managing Logon Hours

Managing Logon Workstations

Managing Account Information

Using Low Speed Connection


Managing Properties for One User Account

To modify one user account

1.	In the User Manager for Domains window, double-click a user account. Or select a user account, and then choose Properties from the User menu.

2.	To change the Full Name or the Description, type new text in those boxes.

3.	To change the password, type a password of up to 14 characters in both the Password and Confirm Password boxes.

For security, the existing password is represented by a row of asterisks, with the number of displayed asterisks different from the actual number of characters used in the password.

4.	Accept or change the setting of the Account Disabled option, and of the password options.

5.	To administer a property associated with one of the buttons at the bottom of the User Properties dialog box, choose one of those buttons and complete the dialog box that appears.

When administering a domain, there are five buttons: Groups, Profile, Hours, Logon From, and Account.  When administering a workstation, only the Groups and Profile buttons are appear.

6.	Choose the OK button.

See Also

Managing Group Memberships for One User Account

Managing Profiles

Managing Logon Hours

Managing Logon Workstations

Managing Account Information

Using Low Speed Connection


Managing Properties for Multiple User Accounts

The advantage of modifying multiple user accounts is that you can make the same change simultaneously to several accounts.

To modify two or more user accounts in the same way

1.	In the User Manager for Domains window, select two or more user accounts.

2.	From the User menu, choose Properties.

3.	To change the Description for all the selected user accounts, type new text in that box.

If all the selected user accounts have an identical description, that text is displayed.  If one or more of the accounts have a different description, the Description box is empty.

4.	To change the settings of the Account Disabled or password options for all the selected user accounts, select or clear those check boxes.

If all the accounts have the same setting for an option, the setting for that check box is displayed.  If one or more of the accounts have a different setting for an option, that check box is indeterminate (filled with gray).

5.	To administer a property associated with one of the buttons at the bottom of the User Properties dialog box, choose one of those buttons and complete the dialog box that appears.

When administering a domain, there are five buttons: Groups, Profile, Hours, Logon From, and Account.  When administering a workstation, only the Groups and Profile buttons are appear.

6.	Choose the OK button.

Any changes you have made are applied to all the selected user accounts.

See Also

Managing Group Memberships for Multiple User Accounts

Managing Profiles

Managing Logon Hours

Managing Logon Workstations

Managing Account Information

Using Low Speed Connection


Managing Group Memberships for One User Account

Use the Group Memberships dialog box to manage the memberships the selected user account has in the groups of the domain or computer being administered.

To manage group memberships when only one user account is selected

1.	Choose the Groups button from the New User, Copy Of, or User Properties dialog box.

2.	To add the user account to one or more groups, select one or more groups in the Not Member Of box, and then choose the Add button.  Or, select one or more groups in the Not Member Of box, and then drag one of the selected group icons into the Member Of box.

3.	To remove the user account from one or more groups, select one or more groups in the Member Of box, and then choose the Remove button.  Or, select one or more groups in the Member Of box, and then drag one of the selected group icons into the Not Member Of box.

You cannot remove the primary group.

4.	To change the user account's primary group, select one global group from the Member Of box, and then choose the Set button.

5.	Choose the OK button.


Managing Group Memberships for Multiple User Accounts

When two or more user accounts are selected, use the Group Memberships dialog box to add all the selected user accounts to one or more groups of this domain or workstation, or to remove all the selected user accounts from one or more groups of this domain or workstation.

To manage common group memberships for two or more user accounts

1.	In the User Manager window, select two or more user accounts, and then choose Properties from the User menu.

2.	In the User Properties dialog box, choose the Groups button.

3.	To add all the user accounts to one or more groups, select one or more groups in the Not All Are Members Of box, and then choose the Add button.  Or, select one or more groups in the Not All Are Members Of box, and then drag one of the selected group icons into the All Are Members Of box.

4.	To remove all the user accounts from one or more groups, select one or more groups in the All Are Members Of box, and then choose the Remove button.  Or, select one or more groups in the All Are Members Of box, and then drag one of the selected group icons into the Not All Are Members Of box.

If even one of the selected user accounts is not a member of a particular group, that group is listed in the Not All Are Members Of box.

You cannot remove a primary group.

5.	To change the primary group for all the selected user accounts, select one global group from the All Are Members Of box, and then choose the Set button.

6.	Choose the OK button.


Managing Profiles

Use the User Environment Profile dialog box to assign a user profile, logon script, or home directory to user accounts.  These assignments are optional.

To configure the user environment profile

1.	Choose the Profile button from the New User, Copy Of, or User Properties dialog box.

2.	Optionally, to assign a user profile, in the User Profile Path box type its full pathname.

The path should be a network path.  The filename can be that of a personal user profile (.USR filename extension) or a mandatory user profile (.MAN filename extension). You might type, for example, \\puma\profiles\clerks.man.

When administering multiple user accounts, do not assign one personal profile to all the accounts.  Either assign a mandatory profile, or substitute %USERNAME%.USR for the filename.  You might type, for example, \\hound\accounts\%username%.usr.

3.	Optionally, to assign a logon script, type the filename in the Logon Script Name box.  If the logon script is stored in a subdirectory of the logon script path, precede the filename with that relative path.

For example, you might type clerks.bat. Or, you might type admins\ernesta.cmd.

4.	Optionally, to specify a home directory, select the Connect box and specify a drive letter, and then select the To box and type a network path.  Or, select the Local Path box and type a local path (including the drive letter).

For example, you might specify drive H and type a network path of \\airedale\users\cristalw.  Or, you might type a local path of c:\users\jeffho.  When administering domain user accounts, specify a network path.

Optionally, substitute %USERNAME% for the last subdirectory in the path. For example, you might specify drive Q and then type a network path of \\airedale\accounts\%username%.

Note:	If no home directory is assigned here, the system assigns the user account the default local home directory (\USERS\DEFAULT on the user's local drive where Windows NT is installed).

5.	Choose the OK button.

See Also

About the User Profile Path


User Profile

A user profile is a special file that is loaded by the system during a user's logon and defines the Windows NT environment that is created for that user.  This definition includes all the user-specific settings of a user's Windows NT environment, such as Program Manager groups and the program items in those groups, screen colors, network connections, printer connections, mouse settings, window size and position, and more.


Logon Script

When a logon script is assigned to a user account, it runs each time the user logs on. It allows an administrator to affect a users environment without managing all aspects of it.  One logon script can be assigned to one or more user accounts.

A logon script can be a batch file (.BAT or .CMD filename extension) or an executable program (.EXE filename extension).  When a user logs on, the computer authenticating the logon locates the logon script by following the computer's logon script path, which is usually \systemroot\SYSTEM32\REPL\IMPORT\SCRIPTS.


Home Directory

A home directory is a directory that is accessible to a user and contains files and programs for that user. It becomes that user's default directory for the File Open and Save As dialog boxes, for the command prompt, and for all applications that do not have a working directory defined. A home directory can be assigned to a single user or it can be shared by many users.  A home directory can be a shared network directory, or a local directory on a user's workstation.

If you specify a network path for the home directory, in most cases User Manager for Domains automatically creates that home directory. If it can't, a message is displayed instructing you to manually create the directory.  If you do not assign a home directory to a user account, the system uses the default local home directory (\USERS\DEFAULT on the user's local drive where Windows NT is installed).

Home directories make it easier for an administrator to back up user files and delete user accounts, because they collect many or all of a user's files in one location.


Using %USERNAME% in the User Profile Path

When entering a user profile path, %USERNAME%.USR can be entered as the filename of a personal profile, and the system later substitutes the user name of each user account for %USERNAME%. This is useful when multiple user accounts are selected.

For example, say you are administering eight user accounts.  In the User Profile Path box you might type \\cat\profiles\%username%.usr, and then choose the OK button.  As the User Environment Profile is saved, for each user account the system substitutes the actual user name for the %USERNAME% entry.

%USERNAME% cannot be used in mandatory user profiles.

Note:	When assigning user profile paths that are stored on a FAT volume, if the user name of at least one of the selected user accounts is longer than 8 characters (or longer than 8.3 characters), MS-DOS clients will not be able to access the home directory. They will be put into the root directory of the share.

However, for NTFS volumes this limit does not apply, and you can use %USERNAME% regardless of the user name length.


Using %USERNAME% in the Home Directory Path

When typing the path for a home directory, %USERNAME% can be entered as the last subdirectory in the path, and the system later substitutes the user name of each user account for %USERNAME%. This is useful when multiple user accounts are selected.

For example, say you are administering six user accounts.  You might select the Connect option, select a drive letter of H, type a path of \\airedale\users\%username%, and then choose the OK button.  As the User Environment Profile is saved, for each user account the system substitutes the actual user name for the %USERNAME% entry.


Managing Logon Hours

Use the Logon Hours dialog box to restrict the days and hours during which a user can connect to a server. The default is to allow a user to connect during all hours of all days of the week, but you can optionally restrict a user to certain days and hours.  This does not affect a user's ability to use a workstation.

To manage logon hours

1.	Choose the Hours button from the New User, Copy Of, or User Properties dialog box.

2.	In the Logon Hours dialog box, select the hours to be administered.

To select one hour, click the box for that hour.  To select a block of hours, click the beginning of the block and drag through the rows and columns to the end of the block.  To select one entire day, click that day in the left column.  To select one hour for all seven days, click the top box of that column.  To select the entire week, click the top left box (above Sunday).

3.	To allow connections during the selected hours, choose the Allow button.  Or, to deny connections during the selected hours, choose the Disallow button.

4.	Repeat steps 2 and 3 as necessary.

5.	Choose the OK button.


Managing Logon Workstations

Use the Logon Workstations dialog box to restrict the workstations from which users can log on to domain accounts.  The default is to allow a user to log on from any workstation, but you can optionally allow a user to log on only from specified workstations.

To manage logon workstations

1.	Choose the Logon From button from the New User, Copy Of, or User Properties dialog box.

2.	Select either User May Log On To All Workstations or User May Log On To These Workstations.

3.	If you select User May Log On To These Workstations, type a computer name in at least one and up to eight of the numbered boxes.

4.	Choose the OK button.


Managing Account Information

Use the Account Information dialog box to define an account expiration date (if any) and the account type for the selected user accounts.

To manage user account information

1.	Choose the Account button from the New User, Copy Of, or User Properties dialog box.

2.	Under Account Expires, select either Never or End Of.

3.	If you select End Of, specify an expiration date in the End Of box.

4.	Under Account Type, select either Global Account or Local Account.

Most accounts are global accounts. Assign local accounts only when a trust relationship does not exist with the user's home domain.

5.	Choose the OK button.


Disabling User Accounts

A disabled user account still exists and is listed in the User Manager for Domains window, but logons to that account are not permitted. Disabled accounts can be restored to enabled status at any time.

To disable or enable a user account

1.	In the User Manager window, select one or more user accounts.

The built-in Administrator account cannot be disabled.

2.	From the User menu, choose Properties.

3.	To prevent logons to the selected user accounts, select the Accounts Disabled check box.  Or, to permit logons to the selected user accounts, clear the Accounts Disabled check box.

4.	Choose the OK button.

See Also

Deleting User Accounts


Deleting User Accounts

Be certain you want to delete a user account before you do so, because a deleted user account cannot be recovered. Internally, Windows NT knows every user account by its security identifier (SID), a unique number that identifies it. If you delete a user account and then create another user account with the same user name, the new user account will not have any of the rights or permissions that were previously granted to the old user account, because the user accounts have different SID numbers.

Because of this, it is a good idea to first disable a user account, and then periodically delete the workstation's disabled accounts. This is a low-risk way to remove users from the workstation.

To delete one or more user accounts

1.	In the User Manager window, select one or more user accounts.

The built-in Administrator and Guest accounts cannot be deleted.

2.	From the User menu, choose Delete.

3.	If a confirmation message is displayed, choose the OK button.

4.	When the delete message is displayed, choose the Yes button. If multiple user accounts are selected, choose the Yes To All button.

See Also

Disabling User Accounts

Using Low Speed Connection


Renaming User Accounts

To rename a user account

1.	In the User Manager window, select one user account.

2.	From the User menu, choose Rename.

3.	In the Change To box, type a user name of up to 20 characters.

A user name cannot be identical to any other user or group name of the domain or computer being administered.  It can contain any uppercase or lowercase characters except for the following:

"  /  \  [  ]  :  ;  |  =  ,  +  *  ?  <  >

4.	Choose the OK button.

See Also

Using Low Speed Connection


Selecting User Accounts

The Select Users command allows you to quickly and easily select or deselect all the user accounts that are members of selected groups. However, only the user accounts listed in the User Manager for Domains window are selected or deselected. Although local groups can contain user or group accounts not from the local domain, those accounts are not affected by choices made in the Select Users dialog box.

Note:	When Low Speed Connection is selected, the Select Users command is unavailable.

To select multiple user accounts

1.	In the User Manager for Domains window, either select the user accounts you want to be initially selected, or select any group to make sure no user accounts are initially selected.

2.	From the User menu, choose Select Users.

3.	To select the member users of a group, select the group from the list and then choose the Select button.

4.	To deselect the member users of a group, select the group from the list and then choose the Deselect button.

5.	Repeat steps 3 and 4 as necessary.

6.	Choose the Close button.  The selected accounts are highlighted in the User Manager for Domains window.

Now that the desired accounts are selected, you can choose a command from the User menu. For example, you might choose Properties and simultaneously modify all the selected user accounts in the same way.

See Also

Using Low Speed Connection


Creating a New Global Group

Note:	When Low Speed Connection is selected, or when you are administering a Window NT Workstation computer or a Windows NT Server computer that is not a domain controller, the New Global Group command is unavailable.

To create a new global group

1.	In the User Manager for Domains window either select the user accounts you want as the initial members of the new group, or select any group to ensure no user accounts are initially selected.

2.	From the User menu, choose New Global Group.

If you selected one or more user accounts in step 1, the selected users are the initial members of the new group.

3.	In the Group Name box, type a group name of up to 20 characters.  A group name cannot be identical to any other group or user name of the domain or computer being administered.  It can contain any uppercase or lowercase characters except for the following:

"  /  \  [  ]  :  ;  |  =  ,  +  *  ?  <  >

4.	In the Description box, type a description.

5.	To add members to the global group, select one or more user accounts from the Not Members box, and then choose the Add button.  Or, select one or more user accounts from the Not Members box, and then drag one of the selected icons to the Members box.

6.	To remove members from the global group, select one or more user accounts from the Members box, and then choose the Remove button.  Or, select one or more user accounts from the Members box, and then drag one of the selected icons to the Not Members box.

7.	When the membership of the global group is defined, choose the OK button.

See Also

Using Low Speed Connection


Copying a Global Group

The main advantage of copying a group is that the new group will have the same members as does the original group.  However, the permissions and rights of the original group are not copied to the new group.

Note:	When Low Speed Connection is selected, or when you are administering a Window NT Workstation computer or a Windows NT Server computer that is not a domain controller, global groups cannot be managed.

To make a copy of an existing global group

1.	In the User Manager for Domains window, select one global group.

2.	From the User menu, choose Copy.

3.	In the Group Name box, type a group name of up to 20 characters.  A group name cannot be identical to any other group or user name of the domain or computer being administered.  It can contain any uppercase or lowercase characters except for the following:

"  /  \  [  ]  :  ;  |  =  ,  +  *  ?  <  >

4.	To change the description, type new text in the Description box.

5.	To add members to the global group, select one or more user accounts from the Not Members box, and then choose the Add button.  Or, select one or more user accounts from the Not Members box, and then drag one of the selected icons into the Members box.

6.	To remove members from the global group, select one or more user accounts from the Members box, and then choose the Remove button.  Or, select one or more user accounts from the Members box, and then drag one of the selected icons to the Not Members box.

7.	When the membership of the global group is defined, choose the OK button.

See Also

Using Low Speed Connection


Managing Global Group Properties

The membership and description of an existing group can be modified.

Note:	When Low Speed Connection is selected, or when you are administering a Window NT Workstation computer or a Windows NT Server computer that is not a domain controller, global groups cannot be managed.

To modify an existing global group

1.	In the User Manager for Domains window, double-click one global group. Or select the global group, and then choose Properties from the User menu.

2.	To change the description, type new text in the Description box.

3.	To add members to the global group, select one or more user accounts from the Not Members box, and then choose the Add button.  Or, select one or more user accounts from the Not Members box, and then drag one of the selected icons into the Members box.

4.	To remove members from the global group, select one or more user accounts from the Members box, and then choose the Remove button.  Or, select one or more user accounts from the Members box, and then drag one of the selected icons to the Not Members box.

5.	Choose the OK button.

See Also

Using Low Speed Connection


Deleting a Global Group

Be certain you want to delete a group before you do so, because a deleted group cannot be recovered. Internally, Windows NT knows every group by its security identifier (SID), a unique number that identifies it. If you delete a group and then create another group with the same group name, the new group will not have any of the rights or permissions that were previously granted to the old group, because the groups have different SID numbers.

Deleting a global group removes only that group; it does not delete the user accounts that were members of the deleted global group.

To delete a global group

1.	In the User Manager for Domains window, select one global group.

Do not select one of the built-in groups.  They cannot be deleted.

2.	From the User menu, choose Delete.

3.	If a confirmation message appears, choose the OK button.

4.	When the delete message appears, choose the Yes button.

See Also

Using Low Speed Connection


Creating a New Local Group

To create a new local group

1.	In the User Manager for Domains window, either select the user accounts you want as the initial members of the new group, or select any group to ensure no user accounts are initially selected.

2.	From the User menu, choose New Local Group.  If you selected one or more user accounts in step 1, the selected users are the initial members of the new group.

3.	To also view the Full Names of the listed user accounts, choose the Show Full Names button.

This can be a lengthy operation when the local group contains numerous users from other domains.

4.	In the Group Name box type a name for the new group.  A group name cannot be identical to any other group or user name of the domain or computer being administered.  It can contain any uppercase or lowercase characters except for the following:

"  /  \  [  ]  :  ;  |  =  ,  +  *  ?  <  >

5.	In the Description box, type a description of the new group.

6.	To add members to the local group, choose the Add button and complete the Add Users And Groups dialog box that appears.

You can add user accounts and global groups from this domain and from trusted domains.

7.	To remove members from the local group, select one or more names from the Members box, and then choose the Remove button.

8.	Choose the OK button.

See Also

Using Low Speed Connection


Copying a Local Group

The main advantage of copying a group is that the new group will have the same members as does the original group.  However, the permissions, rights, and built-in abilities of the original group are not copied to the new group.

To make a copy of an existing local group

1.	In the User Manager for Domains window, select one local group.

2.	From the User menu, choose Copy.

3.	To also view the Full Names of the listed user accounts, choose the Show Full Names button.

This can be a lengthy operation when the local group contains numerous users from other domains.

4.	In the Group Name box, type a name for the new group.  A group name cannot be identical to any other group or user name of the domain or computer being administered.  It can contain any uppercase or lowercase characters except for the following:

"  /  \  [  ]  :  ;  |  =  ,  +  *  ?  <  >

5.	To change the description, type new text in the Description box.

6.	To add members to the local group, choose the Add button and complete the Add Users And Groups dialog box that appears.

You can add user accounts and global groups from this domain and from trusted domains.

7.	To remove members from the local group, select one or more names from the Members box, and then choose the Remove button.

8.	Choose the OK button.

See Also

Using Low Speed Connection


Managing Local Group Properties

The membership and description of an existing local group can be modified.

To modify a local group

1.	In the User Manager for Domains window, double-click one local group. Or select the local group, and then from the User menu choose Properties.

2.	To also view the Full Names of the listed user accounts, choose the Show Full Names button.

This can be a lengthy operation when the local group contains numerous users from other domains.

3.	To change the description, type new text in the Description box.

4.	To add members to the local group, choose the Add button and complete the Add Users And Groups dialog box that appears.

You can add user accounts and global groups from this domain and from trusted domains.

5.	To remove members from the local group, select one or more names from the Members box, and then choose the Remove button.

6.	Choose the OK button.

See Also

Using Low Speed Connection


Deleting a Local Group

Be certain you want to delete a group before you do so, because a deleted group cannot be recovered. Internally, Windows NT knows every group by its security identifier (SID), a unique number that identifies it. If you delete a group and then create another group with the same group name, the new group will not have any of the rights or permissions that were previously granted to the old group, because the groups have different SID numbers.

Deleting a local group removes only that group; it does not delete the user accounts and global groups that were members of the deleted local group.

To delete a local group

1.	In the User Manager for Domains window, select one local group.

Do not select one of the built-in groups.  They cannot be deleted.

2.	From the User menu, choose Delete.

3.	If a confirmation message appears, choose the OK button.

4.	When the delete message appears, choose the Yes button.

See Also

Using Low Speed Connection


Managing the Account Policy

The Account policy controls how passwords must be used by all user accounts.

To manage the Account policy

1.	From the Policies menu, choose Account.

2.	Under Maximum Password Age, enter a value between 1 and 999 days, or select Password Never Expires.

3.	Under Minimum Password Age, enter a value between 1 and 999 days, or select Allow Changes Immediately.

If here you select the Allow Changes Immediately option, then under Password Uniqueness you must select the Do Not Keep Password History option.

4.	Under Minimum Password Length, enter a value between 1 and 14 characters, or select Permit Blank Password.

5.	Under Password Uniqueness, enter a value between 1 and 24 passwords, or select Do Not Keep Password History.

If here you enter a uniqueness value (for example, Remember 4 Passwords), then under Minimum Password Age you must specify an age value (for example, Allow Changes in 7 Days).

6.	Select either the No Account Lockout or Account Lockout option. If you select Account Lockout, you must also specify values for Lockout After, Reset Count After, and Lockout Duration.

7.	Select or clear the Forcibly Disconnect Remote Users From Server When Logon Hours Expire check box.

8.	Select or clear the Users Must Log On In Order To Change Password check box.

9.	Choose the OK button.


Managing the User Rights Policy

A right authorizes a user to perform certain actions on the system.  Use the User Rights policy to manage the rights granted to groups and user accounts.

Note:	In most situations, the easiest way to provide rights to a user is to add that user's account to one of the built-in groups that already possesses the needed rights, rather than by managing the User Rights policy.

To manage the User Rights policy

1.	From the Policies menu, choose User Rights.

2.	Select a user right from those listed in the Right box.  When you select a right, the Grant To box lists the groups and user accounts that are granted that right.

3.	To grant that right to additional groups or user accounts, choose the Add button and complete the Add Users And Groups dialog box that appears.

4.	To remove a group or user account from the list of those granted this right, select a name in the Grant To box, and then choose the Remove button.

5.	Repeat steps 2 through 4 as necessary.

6.	To administer the advanced user rights, select the Show Advanced User Rights option, and then perform steps 2 through 4.  Advanced rights are primarily used by programmers writing applications to run on Windows NT.

7.	Choose the OK button.

See Also

The User Rights


Managing the Audit Policy

Windows NT can track selected activities of users, by auditing security events and then placing entries in a computer's security log.  Windows NT can record a range of security event types, from a system-wide event such as a user logging on, to an attempt by a user to read a specific file. Both successful and unsuccessful attempts to perform an action can be recorded.

Use the Audit policy to determine the types of security events Windows NT will log.  When administering domains, the Audit policy affects the security logs of the domain controller and of all servers in the domain, because they share the same Audit policy. When administering a Windows NT workstation, this policy affects only the security log of that computer.

Because the security log is limited in size, carefully choose the events to be logged.  The maximum size of each computer's security log is defined in Event Viewer.  Entries in a security log can be reviewed using Event Viewer.

To manage the Audit Policy

1.	From the Policies menu, choose Audit.

2.	To record events in the security log, select Audit These Events.  Or, to not record any events in the security log, select Do Not Audit.

3.	If you selected Audit These Events, specify the events to be audited by selecting or clearing the Success and Failure check box for each type of event.

4.	Choose the OK button.


Permitting Another Domain to Trust

Establishing a trust relationship requires two steps:  first, one domain must permit a second domain to trust it, and then the second domain must be set to trust the first domain.  Because the trust relationship is not yet established, it may often be necessary for these two steps to be performed by separate administrators.

To permit another domain to trust this domain

1.	If User Manager for Domains does not already display the appropriate domain, from the User menu choose Select Domain, and complete the Select Domain dialog box that appears, specifying the name of the domain that will be configured to permit another to trust it.

2.	From the Policies menu, choose Trust Relationships.

The Trust Relationships dialog box lists the trust relationships for the domain.

3.	Choose the Add button next to the Permitted To Trust This Domain box.

4.	In the Domain To Permit box, type the name of the Windows NT Server domain that will be allowed to trust this domain.

You can type a name using both uppercase and lowercase characters, but the name will always be displayed uppercase.

5.	Type a password in both the Password and Confirm Password boxes.

Passwords are case sensitive.  (Windows NT distinguishes between uppercase and lowercase characters in passwords.)

6.	In the Permit Domain To Trust dialog box, choose the OK button

In the Trust Relationships dialog box, the added name is displayed in the Permitted To Trust This Domain list.

7.	In the Trust Relationships dialog box, choose the Close button.

8.	Provide the password to the administrator of the domain that you have permitted to trust this domain.  That administrator must complete the trust relationship by having that domain trust this one.

See Also

Trusting Another Domain


Trusting Another Domain

Establishing a trust relationship requires two steps:  first, one domain must permit a second domain to trust it, and then the second domain must be set to trust the first domain.  Because the trust relationship is not yet established, it may often be necessary for these two steps to be performed by separate administrators.

To trust another domain

1.	Obtain a password from the administrator of the domain that will be trusted.

2.	If User Manager for Domains does not already display the appropriate domain, from the User menu choose Select Domain and complete the Select Domain dialog box that appears, specifying the name of the domain that will be configured to trust another.

3.	From the Policies menu, choose Trust Relationships.

The Trust Relationships dialog box appears, showing the trust relationships for the domain.

4.	Choose the Add button next to the Trusted Domains box.

5.	In the Domain box, type the name of the Windows NT Server domain that is to be trusted.

You can type a name using both uppercase and lowercase characters, but the name is always displayed in uppercase.

6.	In the Password box, type the password required by that domain.

Passwords are case sensitive.  (Windows NT distinguishes between uppercase and lowercase characters in passwords.)

7.	In the Add Trusted Domain dialog box, choose the OK button.

In the Trust Relationships dialog box, the added name is displayed in the Trusted Domains list.

8.	In the Trust Relationships dialog box, choose the Close button.

See Also

Permitting Another Domain to Trust


The User Rights

The list below provides descriptions of user rights that can be managed with the User Rights policy.

Note:	In addition to the rights listed below, some advanced user rights can also be managed with the User Rights policy.  Most advanced user rights are useful only to programmers writing applications to run on Windows NT, and will not usually be granted to a group or user.  For information on advanced user rights, see the Windows NT programming documentation.  However, two advanced user rights (Bypass Traverse Checking, and Log On As A Service) may be of interest to administrators, and are therefore included in the list.

For information on a user right, choose one of the following buttons.

 Access this computer from network

 Add workstations to domain

 Back up files and directories

 Change the system time

 Force shutdown from a remote system

 Load and unload device drivers

 Log on locally

 Manage auditing and security log

 Restore files and directories

 Shut down the system

 Take ownership of files or other objects

 Bypass traverse checking (advanced right)

 Log on as a service (advanced right)

See Also

Managing the User Rights Policy


Access this computer from network

Allows a user to connect to the computer over the network.

Note:	When administering a domain, this right applies to the domain controller and the other servers of the domain.  When administering a workstation, this right applies only to that workstation.


Add workstations to domain

Allows a user to add workstations to the domain.  Adding a workstation to a domain makes the workstation able to recognize the domain's user and global groups accounts.

Note:	Members of a domain's Administrators and Server Operators groups can always add workstations to the domain, even if they aren't granted this right.


Back up files and directories

Allows a user to back up files and directories of the computer. This right supersedes files and directory permissions.

Note:	When administering a domain, this right applies to the primary and backup domain controllers of the domain.  When administering a workstation or a server that is not a domain controller, this right applies only to that computer.


Change the system time

Allows a user to set the time for the internal clock of the computer.

Note:	When administering a domain, this right applies to the primary and backup domain controllers of the domain.  When administering a workstation or a server that is not a domain controller, this right applies only to that computer.


Force shutdown from a remote system

This right is not currently implemented. It is reserved for future use.


Load and unload device drivers

Allows a user to dynamically load and unload device drivers.

Note:	When administering a domain, this right applies to the primary and backup domain controllers of the domain.  When administering a workstation or a server that is not a domain controller, this right applies only to that computer.


Log on locally

Allows a user to log on at the computer.

Note:	When administering a domain, this right applies to the primary and backup domain controllers of the domain.  When administering a workstation or a server that is not a domain controller, this right applies only to that computer.


Manage auditing and security log

Allows a user to manage the auditing of files, directories, and other objects. A user with this right can specify which objects are protected by auditing, and which users and groups and what types of access are audited.

This right does not affect who can use the Audit command in the Policies menu of User Manager to configure what security events are audited. This ability is always held only by Administrators.

Note:	When administering a domain, this right applies to the primary and backup domain controllers of the domain.  When administering a workstation or a server that is not a domain controller, this right applies only to that computer.


Restore files and directories

Allows a user to restore files and directories of the computer. This right supersedes files and directory permissions.

Note:	When administering a domain, this right applies to the primary and backup domain controllers of the domain.  When administering a workstation or a server that is not a domain controller, this right applies only to that computer.


Shut down the system

Allows a user to shut down Windows NT at the computer.

Note:	When administering a domain, this right applies to the primary and backup domain controllers of the domain.  When administering a workstation or a server that is not a domain controller, this right applies only to that computer.


Take ownership of files or other objects

Allows a user to take ownership of files, directories, and other objects of the computer.

Note:	When administering a domain, this right applies to the primary and backup domain controllers of the domain.  When administering a workstation or a server that is not a domain controller, this right applies only to that computer.


Bypass traverse checking

Allows a user to change directories and travel through directory trees of the computer, even if the user has no permissions for the traversed directories.  This is an advanced user right.

Note:	When administering a domain, this right applies to the primary and backup domain controllers of the domain.  When administering a workstation or a server that is not a domain controller, this right applies only to that computer.


Log on as a service

Allows a process to register with the system as a service.  This is an advanced user right.

Note:	When administering a domain, this right applies to the primary and backup domain controllers of the domain.  When administering a workstation or a server that is not a domain controller, this right applies only to that computer.


New User (on a Server) dialog box
New User

Use the New User dialog box to create new user accounts.  For more information, choose one of the following buttons.

 Username

 Full Name

 Description

 Password and Confirm Password

 User Must Change Password At Next Logon

 User Cannot Change Password

 Password Never Expires

 Account Disabled

 Groups button

 Profile button

 Hours button

 Logon From button

 Account button

 Add button

See Also

Creating a New User Account


Username

The user name identifies the user account.   A user name cannot be identical to any other user or group name of the domain or computer being administered.  It can contain any uppercase or lowercase characters except for the following:

"  /  \  [  ]  :  ;  |  =  ,  +  *  ?  <  >

In the Username box, enter a unique name of up to 20 characters.


Username

The user name identifies the user account.  The user name cannot be changed from this dialog box.  To change the user name of an existing user account, use the Rename command from the User menu.


Users

The user accounts being administered.  Any changes made to the entries and settings of this dialog box are applied to all these accounts.


Full Name

The full name is the user's complete name.  It is a good idea to establish a standard for entering full names, so that they always begin with either the first name (Louise G. Morgan) or the last name (Morgan, Louise G.), because the first few characters of the full name determine the user account sort order in the User Manager for Domains window.

To enter or change the full name, enter new text in the Full Name box.


Description

The description can be any text describing the user account or the user.

To enter a description, type appropriate text in the Description box.


Description

The description is copied from the original account, and can be any text describing the user account or the user.  You can accept the description that was copied, or you can replace it.

To change the description, type new text in the Description box.


Description

The description can be any text describing the user account or the user.  You can accept the existing description, or you can replace it.

To change the description, type new text in the Description box.


Description

If all the selected user accounts have an identical description, that text appears in the Description box.  If one or more of the accounts have a different description, the Description box is empty.  You can leave the descriptions unchanged, or you can provide one new description for all the selected user accounts.

To provide the same description for all the selected user accounts, type new text in the Description box.


Password and Confirm Password

A password can be up to 14 characters.  It is case sensitive.  (Windows NT distinguishes between uppercase and lowercase characters in passwords.)

Type a password in the Password box, and then type that same password in the Confirm Password box.


Password and Confirm Password

A password can be up to 14 characters.  It is case sensitive.  (Windows NT distinguishes between uppercase and lowercase characters in passwords.)

You can change the existing password, or leave it unchanged.

To change the user's password, type a new password in the Password box, and then type that same password in the Confirm Password box.


User Must Change Password At Next Logon

To force the user to change the password at the next logon, select this option.


User Must Change Password At Next Logon

Usually, after a copy this option is selected, regardless of its setting in the original account.  However, if the User Cannot Change Password option is selected in the original account, that selection is copied, and the User Must Change Password At Next Logon option is cleared.

To force the user to change the password at the next logon, select this option.


User Must Change Password At Next Logon

During a copy, this option is initially cleared regardless of the setting in the original account.

To force the user to change the password at the next logon, select this option.


User Cannot Change Password

This option is usually applied only to user accounts (such as the Guest account) used by more than one person.

To prevent the user from changing the assigned password, select this option.


User Cannot Change Password

This option is usually applied only to user accounts (such as the Guest account) used by more than one person.

During a copy, the setting for this option is copied from the original account.

To prevent the user from changing the assigned password, select this option.


Users Cannot Change Password

This option is usually applied only to user accounts (such as the Guest account) used by more than one person.  If all the selected user accounts have the same setting for this option, that setting is displayed.  If one or more of the accounts have a different setting for this option, the check box is indeterminate (filled with gray).

To prevent all the selected users from changing their assigned passwords, select this option.


User Cannot Change Password

This option is usually applied only to user accounts (such as the Guest account) used by more than one person.

To prevent the user from changing the assigned password, select this option.


User Cannot Change Password

This option is usually applied only to user accounts (such as the Guest account) used by more than one person.

During a copy, the setting for this option is copied from the original account.

To prevent the user from changing the assigned password, select this option.


Users Cannot Change Password

This option is usually applied only to user accounts (such as the Guest account) used by more than one person.  If all the selected user accounts have the same setting for this option, that setting is displayed.  If one or more of the accounts have a different setting for this option, the check box is indeterminate (filled with gray).

To prevent all the selected users from changing their assigned passwords, select this option.


Password Never Expires

Prevents the password from expiring, overriding the Maximum Password Age setting in the Account policy.  Select this option for user accounts which will be assigned to services (for example, to the Directory Replicator service) using Server Manager, or the Services option in Control Panel.  Selection of this option overrides a selection of the User Must Change Password At Next Logon option.

To prevent the password from expiring, select this option.


Password Never Expires

Prevents the password from expiring, overriding the Maximum Password Age setting in the Account policy.  Select this option for user accounts which will be assigned to services (for example, to the Directory Replicator service) using Server Manager, or the Services option in Control Panel.  Selection of this option overrides a selection of the User Must Change Password At Next Logon option.

During a copy, the setting for this option is copied from the original account.

To prevent the password from expiring, select this option.


Passwords Never Expire

Prevents the password from expiring, overriding the Maximum Password Age setting in the Account policy.  Select this option for user accounts which will be assigned to services (for example, to the Directory Replicator service) using Server Manager, or the Services option in Control Panel.

If all the selected user accounts have the same setting for this option, that setting is displayed.  If one or more of the accounts have a different setting for this option, the check box is indeterminate (filled with gray).

To prevent the passwords of all the selected user accounts from expiring, select this option.


Account Disabled

To prevent use of this account, select this option.

For example, you might disable a new account to create an inactive, template account that can be copied to create new accounts.  Or, you might temporarily disable an account if it does not need to be used until a later date.

The built-in Administrator account cannot be disabled.


Account Disabled

During a copy, this option is initially cleared, regardless of the setting in the original account, so that active accounts can be rapidly created by copying disabled template accounts.

To prevent use of this account, select this option.

For example, you might disable a new account to create an inactive, template account that can be copied to create new accounts.  Or, you might temporarily disable an account if it does not need to be used until a later date.

The built-in Administrator account cannot be disabled.


Accounts Disabled

If all the selected user accounts have the same setting for this option, that setting is displayed.  If one or more of the accounts have a different setting for this option, the check box is indeterminate (filled with gray).

To prevent use of all the selected user accounts, select this option.

For example, you might disable accounts to create inactive, template accounts that can be copied to create new accounts.  Or, you might temporarily disable accounts if they do not need to be used until a later date.


Account Locked Out

If the account is currently locked out, this option is selected and available. If the account is not locked out, the option is cleared and unavailable.

To unlock this account, clear the check box.

You cannot use this option to lock an account; you can only use it to unlock accounts that become locked because of too many incorrect logon attempts. If you want to prevent use of an account, disable it.


Accounts Locked Out

If all selected accounts are currently locked out, this option is selected and available. If some are locked out, the check box is indeterminate (filled with gray). If none are locked, the check box is cleared and unavailable.

To unlock all selected accounts, clear the check box.

You cannot use this option to lock accounts; you can only use it to unlock accounts that become locked because of too many incorrect logon attempts. If you want to prevent the use of accounts, disable them.


Groups button

To specify the groups in which the user account will have membership, choose the Groups button.


Groups button

To change the group memberships of the new user account, choose the Groups button.

The initial group memberships for the new user account are copied from the original account.


Groups button

To specify the groups in which all the selected user accounts will have membership, choose the Groups button.


Profile button

To assign a user profile, logon script, or home directory to the user account, choose the Profile button.


Profile button

To assign a user profile, logon script, or home directory to all the selected user accounts, choose the Profile button.


Profile button

To assign a logon script or home directory to the user account, choose the Profile button.


Profile button

To assign a logon script or home directory to all the selected user accounts, choose the Profile button.


Hours button

To restrict the hours during which the user can connect to a server, choose the Hours button.  This does not affect a user's ability to use a workstation.


Hours button

To restrict the hours during which the user can connect to a server, choose the Hours button.  This does not affect a user's ability to use a workstation.

The initial settings for the logon hours are copied from the original account.


Hours button

To restrict the hours during which all the selected user accounts can connect to a server, choose the Hours button.  This does not affect those users' ability to use workstations.


Logon From button

To restrict the workstations from which a user will be permitted to log on to this domain account, choose the Logon From button.


Logon From button

To restrict the workstations from which a user will be permitted to log on to this domain account, choose the Logon From button.

The initial settings for the logon workstations are copied from the original account.


Logon From button

To restrict the workstations from which users will be permitted to log on to these domain accounts, choose the Logon From button.


Account button

To manage the account expiration date and to specify whether this is a global or a local user account, choose the Account button.


Account button

To manage the account expiration date and to specify whether this is a global or a local user account, choose the Account button.

The initial settings for this information are copied from the original user account.


Account button

To manage the account expiration date for all the selected user accounts, and to specify whether these are global or local user accounts, choose the Account button.


Account button

To manage the account expiration date for the user account, and to specify the privilege level, choose the Account button.


Account button

To manage the account expiration date for all the selected user accounts, and to specify their privilege level, choose the Account button.


Add button

Choose the Add button to add the new user account.

The new account is added.  The New User dialog box reverts to its default settings, ready for you to add another new user account.


Add button

Choose the Add button to add the new user account.

The new account is added.  The Copy Of dialog box reverts to its initial settings, ready for you to add another copy of the original account.


New User (on a Workstation) dialog box
New User

Use the New User dialog box to add new user accounts.  For more information, choose one of the following buttons.

 Username

 Full Name

 Description

 Password and Confirm Password

 User Must Change Password At Next Logon

 User Cannot Change Password

 Password Never Expires

 Account Disabled

 Groups button

 Profile button

See Also

Creating a New User Account


New User (on LAN Manager) dialog box
New User

Use the New User dialog box to add new user accounts.  For more information, choose one of the following buttons.

 Username

 Full Name

 Description

 Password and Confirm Password

 User Cannot Change Password

 Account Disabled

 Groups button

 Profile button

 Hours button

 Logon From button

 Account button

 Add button

See Also

Creating a New User Account


Copy of User Account (on a Server) dialog box
Copy of User Account

Use the Copy Of dialog box to create new user accounts copied from an existing one.  You may want to copy an account, for example, to add a new user who belongs to the same groups as an existing user.  For more information, choose one of the following buttons.

 Username

 Full Name

 Description

 Password and Confirm Password

 User Must Change Password At Next Logon

 User Cannot Change Password

 Password Never Expires

 Account Disabled

 Groups button

 Profile button

 Hours button

 Logon From button

 Account button

 Add button

See Also

Copying a User Account


Copy of User Account (on a Workstation) dialog box
Copy of User Account

Use the Copy Of dialog box to create new user accounts copied from an existing one.  You may want to copy an account, for example, to add a new user who belongs to the same groups as an existing user.  For more information, choose one of the following buttons.

 Username

 Full Name

 Description

 Password and Confirm Password

 User Must Change Password At Next Logon

 User Cannot Change Password

 Password Never Expires

 Account Disabled

 Groups button

 Profile button

See Also

Copying a User Account


Copy of User Account (on LAN Manager) dialog box
Copy of User Account

Use the Copy Of dialog box to create new user accounts copied from an existing one.  You may want to copy an account, for example, to add a new user who belongs to the same groups as an existing user.  For more information, choose one of the following buttons.

 Username

 Full Name

 Description

 Password and Confirm Password

 User Cannot Change Password

 Account Disabled

 Groups button

 Profile button

 Hours button

 Logon From button

 Account button

 Add button

See Also

Copying a User Account


User Properties (on a Server) dialog box
User Properties

Use the User Properties dialog box to modify the selected user account.  For more information, choose one of the following buttons. (If you have additional services installed, you may have additional options. For information on those options, see the documentation for those services.)

 Username

 Full Name

 Description

 Password and Confirm Password

 User Must Change Password At Next Logon

 User Cannot Change Password

 Password Never Expires

 Account Disabled

 Account Locked Out

 Groups button

 Profile button

 Hours button

 Logon From button

 Account button

See Also

Managing Properties for One User Account


User Properties (on a Workstation) dialog box
User Properties

Use the User Properties dialog box to modify the selected user account.  For more information, choose one of the following buttons.

 Username

 Full Name

 Description

 Password and Confirm Password

 User Must Change Password At Next Logon

 User Cannot Change Password

 Password Never Expires

 Account Disabled

 Account Locked Out

 Groups button

 Profile button

See Also

Managing Properties for One User Account


User Properties (on LAN Manager) dialog box
User Properties

Use the User Properties dialog box to modify the selected user account.  For more information, choose one of the following buttons.

 Username

 Full Name

 Description

 Password and Confirm Password

 User Cannot Change Password

 Account Disabled

 Account Locked Out

 Groups button

 Profile button

 Hours button

 Logon From button

 Account button

See Also

Managing Properties for One User Account


User Properties

Use the User Properties dialog box to modify all the selected user accounts in the same way.  For more information, choose one of the following buttons. (If you have additional services installed, you may have additional options. For information on those options, see the documentation for those services.)

 Users

 Description

 Users Cannot Change Password

 Password Never Expires

 Accounts Disabled

 Accounts Locked Out

 Groups button

 Profile button

 Hours button

 Logon From button

 Account button

See Also

Managing Properties for Multiple User Accounts


User Properties

Use the User Properties dialog box to modify all the selected user accounts in the same way.  For more information, choose one of the following buttons.

 Users

 Description

 Users Cannot Change Password

 Password Never Expires

 Accounts Disabled

 Accounts Locked Out

 Groups button

 Profile button

See Also

Managing Properties for Multiple User Accounts


User Properties

Use the User Properties dialog box to modify all the selected user accounts in the same way.  For more information, choose one of the following buttons.

 Users

 Description

 Users Cannot Change Password

 Accounts Disabled

 Accounts Locked Out

 Groups button

 Profile button

 Hours button

 Logon From button

 Account button

See Also

Managing Properties for Multiple User Accounts


Group Memberships (on a Server) dialog box
Group Memberships

Use the Group Memberships dialog box to establish or change the memberships this user account has in the groups of this domain.  For more information, choose one of the following buttons.

 User

 Member Of

 Not Member Of

 Add button

 Remove button

 Set button

 Primary Group

See Also

Managing Group Memberships for One User Account


User

The user account being administered.


Users

The selected user accounts.


Member Of

The user account is a member of these groups.


All Are Members Of

Every one of the selected user accounts belongs to these groups.

Note:	If even one of the selected user accounts does not belong to a particular group, the group is not listed in this box.


Not Member Of

The user account does not belong to these groups.


Not All Are Members Of

If even one of the selected user accounts is not a member of a particular group, that group is listed in the Not All Are Members Of box.


Add button

To add the selected user account to one or more groups, select one or more groups in the Not Member Of box, and then choose the Add button.

Or, select one or more groups in the Not Member Of box, and then drag one of the selected group icons into the Member Of box.


Add button

To add all the selected user accounts to one or more groups, select one or more groups in the Not All Are Members Of box, and then choose the Add button.

Or, select one or more groups in the Not All Are Members Of box, and then drag one of the selected group icons into the All Are Members Of box.


Remove button

To remove the selected user account from one or more groups, select one or more groups in the Member Of box, and then choose the Remove button.  Or, select one or more groups in the Member Of box, and then drag one of the selected group icons into the Not Member Of box.

You cannot remove the primary group.


Remove button

To remove all the selected user accounts from one or more groups, select one or more groups in the All Are Members Of box, and then choose the Remove button.  Or, select one or more groups in the All Are Members Of box, and then drag one of the selected group icons into the Not All Are Members Of box.

You cannot remove a primary group.


Set button

To change the user account's primary group, select a global group from the Member Of box, and then choose the Set button.

A primary group is used when a user logs on using Windows NT Services for Macintosh, or runs POSIX applications.  Only a global group can be set as the primary group.  A user account cannot be removed from membership in its primary group.


Set button

To change the primary group of all the selected user accounts, select a global group from the All Are Members Of box, and then choose the Set button.

A primary group is used when users log on using Windows NT Services for Macintosh, or run POSIX applications.  Only a global group can be set as the primary group.  User accounts cannot be removed from membership in their primary groups.


Primary Group

The global group set as the primary group for this user.  A primary group is used when a user logs on using Windows NT Services for Macintosh, or runs POSIX applications.

A user account cannot be removed from membership in its primary group.


Primary Group

The global group set as the primary group for the selected user accounts.  A primary group is used when users log on using Windows NT Services for Macintosh, or run POSIX applications.

If no primary group is shown, the selected user accounts are not all set to the same primary group.  A user account cannot be removed from membership in its primary group.


Group Memberships (on a Workstation) dialog box
Group Memberships

Use the Group Memberships dialog box to establish or change the group memberships for all the selected users.  For more information, choose one of the following buttons.

 User

 Member Of

 Not Member Of

 Add button

 Remove button


Group Memberships

Use the Group Memberships dialog box to add all the selected user accounts to one or more groups of this domain or workstation, or to remove all the selected user accounts from one or more groups of this domain or workstation.

For more information, choose one of the following buttons.

 Users

 All Are Members Of

 Not All Are Members Of

 Add button

 Remove button

 Set button

 Primary Group

See Also

Managing Group Memberships for Multiple User Accounts


Group Memberships

Use the Group Memberships dialog box to add all the selected user accounts to one or more groups of this workstation, or to remove all the selected user accounts from one or more groups of this workstation.

For more information, choose one of the following buttons.

 Users

 All Are Members Of

 Not All Are Members Of

 Add button

 Remove button


User Environment Profile (on a Server) dialog box
User Environment Profile

Use the User Environment Profile dialog box to assign a user profile, logon script, or home directory to this user account.  These assignments are optional.  For more information, choose one of the following buttons. (If you have additional services installed, you may have additional options. For information on those options, see the documentation for those services.)

 User

 User Profile Path

 Using %USERNAME% in the User Profile Path

 Logon Script Name

 Home Directory

 Local Path

 Connect To

 Using %USERNAME% in the Home Directory Path

See Also

About the User Profile Path

Managing Profiles


User Profile Path

Optionally, to assign a user profile, in the User Profile Path box type its full pathname.

The path should be a network path.  The filename can be that of a personal user profile (.USR filename extension) or a mandatory user profile (.MAN filename extension). You might type, for example, \\cat\profiles\jeffho.usr.


User Profile Path

Optionally, to assign a user profile to all the selected user accounts, in the User Profile Path box type its full pathname.

The path should be a network path.  The filename can be that of a personal user profile (.USR filename extension) or a mandatory user profile (.MAN filename extension). You might type, for example, \\puma\profiles\clerks.man.

When administering multiple user accounts, do not assign one personal profile to all the accounts.  Either assign a mandatory profile, or substitute %USERNAME%.USR for the filename.  You might type, for example, \\hound\accounts\%username%.usr.


Logon Script Name

If a logon script is assigned to a user account, it runs each time the user logs on.  It can be a batch file (.BAT or .CMD filename extension) or an executable program (.EXE filename extension).  One logon script can be assigned to one or more user accounts.  When a user logs on, the server authenticating the logon locates the logon script by following the server's logon script path (usually \systemroot\SYSTEM32\REPL\IMPORT\SCRIPTS).

To assign a logon script to the selected users, type a filename in the Logon Script Name box.  If the logon script is located in a subdirectory of the logon script path, precede the filename with that relative path.

For example, you might type clerks.bat; or, you might type admins\ernesta.cmd.


Logon Script

For Microsoft LAN Manager, a logon script is a batch program containing LAN Manager and operating system commands used to configure workstations.  A logon script can be assigned to one or more users.  When the user logs on, the logon script runs on the server.

Optionally, to assign a logon script, type the filename in the Logon Script box.


Logon Script Name

If a logon script is assigned to a user account, it runs each time the user logs on.  It can be a batch file (.BAT or .CMD filename extension) or an executable program (.EXE filename extension).  One logon script can be assigned to one or more user accounts.  When a user logs on, the workstation locates the logon script by following the workstation's logon script path (usually \systemroot\SYSTEM32\REPL\IMPORT\SCRIPTS).

To assign a logon script to the selected users, type a filename in the Logon Script Name box.  If the logon script is located in a subdirectory of the default logon script path, precede the filename with that relative path.

For example, you might type clerks.bat; or, you might type admins\ernesta.cmd.


Home Directory

A home directory is a directory that is accessible to a user and contains files and programs for that user. It becomes that user's default directory for the File Open and Save As dialog boxes, for the command prompt, and for all applications that do not have a working directory defined. A home directory can be assigned to a single user or it can be shared by many users.  A home directory can be a shared network directory or a local directory on a user's workstation.

If you specify a network path for the home directory, in most cases User Manager for Domains automatically creates that home directory. If it can't, a message is displayed instructing you to manually create the directory.  If you do not assign a home directory to a user account, the system uses the default local home directory (\USERS\DEFAULT on the user's local drive where Windows NT is installed).

Home directories make it easier for an administrator to back up user files and delete user accounts, because they collect many or all of a user's files in one location.


Home Directory

A home directory is a directory that is accessible to a user and contains files and programs for that user.  For Microsoft LAN Manager, this can be a directory local to the user, or a directory on a server running user-level security.

To specify a home directory for a user, in the Home Directory box, type the path for that directory.  This can be an absolute path or a network path.  The suggested path follows the form \\servername\USERS\username.


Local Path

Optionally, to specify a home directory at the workstation where the user logs on, type a local path in the Local Path box.

For example, you might type c:\users\johnbr.


Connect To

Optionally, to specify a shared network directory as the home directory, specify a drive letter in the Connect box, and then type a network path in the To box.

For example, you might specify drive J, and then type \\airedale\users\johnbr.


User Environment Profile

Use the User Environment Profile dialog box to assign a user profile, logon script, or home directory to all the selected user accounts.  These assignments are optional.  For more information, choose one of the following buttons.

 Users

 User Profile Path

 Using %USERNAME% in the User Profile Path

 Logon Script Name

 Home Directory

 Local Path

 Connect To

 Using %USERNAME% in the Home Directory Path

See Also

About the User Profile Path

Managing Profiles


User Environment Profile (on LAN Manager) dialog box
User Environment Profile

Use the User Environment Profile dialog box to assign a logon script or home directory to this user account.  These assignments are optional.  For more information, choose one of the following buttons.

 User

 Logon Script

 Home Directory


User Environment Profile

Use the User Environment Profile dialog box to assign a logon script or home directory to all the selected user accounts.  These assignments are optional.  For more information, choose one of the following buttons.

 Users

 Logon Script

 Home Directory


Logon Hours dialog box
Logon Hours

Use the Logon Hours dialog box to restrict the days and hours during which a user can connect to a server. The default is to allow a user to connect during all hours of all days of the week, but you can optionally restrict a user to certain days and hours.  This does not affect a user's ability to use a workstation.

For more information, choose one of the following buttons.

 About the Calendar

 Allow button

 Disallow button

See Also

Managing Logon Hours


About the Calendar

The Logon Hours dialog box displays a one-week calendar, with logon hours indicated in one-hour increments across seven days. One box represents each hour. For example, the first box in each row represents the hour from midnight through 12:59 A.M.; the last box in each row represents the hour from 11:00 P.M. through 11:59 P.M.

When a box on the calendar is filled, the user is allowed to connect to servers during that hour. When a box is empty, the user cannot connect to servers during that hour.


Allow button

To allow connections during certain hours, select those hours and then choose the Allow button.  The selected boxes are filled, indicating connections are allowed during those hours.


Disallow button

When a user is connected to a server and logon hours are exceeded, the user is either disconnected from all server connections, or is allowed to remain connected but is denied any new connections. This behavior depends on an option (called Forcibly Disconnect Remote Users From Server When Logon Hours Expire) in the Account Policy dialog box.

To deny connections during certain hours, select those hours and then choose the Disallow button.  The selected boxes are cleared, indicating connections are not allowed during those hours.


Logon Workstations (on a Server) dialog box
Logon Workstations

Use the Logon Workstations dialog box to specify the workstations from which a user can log on to this domain account.  The default is to allow a user to log on from any workstation, but you can optionally allow a user to log on only from specified workstations.

For more information, choose one of the following buttons. (If you have additional services installed, you may have additional options. For information on those options, see the documentation for those services.)

 User

 User May Log On To All Workstations

 User May Log On To These Workstations

 Boxes 1 through 8

See Also

Managing Logon Workstations


User May Log On To All Workstations

Allows the user to log on from all workstations.


Users May Log On To All Workstations

Allows the selected users to log on from all workstations.


User May Log On To These Workstations

Allows the user to log on only to the computers entered in boxes 1 through 8.


Users May Log On To These Workstations

Allows the selected users to log on only to the computers entered in boxes 1 through 8.


Boxes 1 through 8

If the User May Log On To These Workstations option is selected, the user can log on only from the workstations entered in boxes 1 through 8.

To specify the logon workstations for the user, enter computer names in at least one and up to eight of the numbered boxes.


Boxes 1 through 8

If the User May Log On To These Workstations option is selected, the selected users can log on only from the workstations entered in boxes 1 through 8.

To specify the logon workstations for all the selected users, enter computer names in at least one and up to eight of the numbered boxes.


Logon Workstations

Use the Logon Workstations dialog box to restrict the workstations from which users can log on to these domain accounts.  The default is to allow users to log on from any workstation, but you can optionally allow users to log on only from specified workstations. (If you have additional services installed, you may have additional options. For information on those options, see the documentation for those services.)

For more information, choose one of the following buttons.

 Users

 Users May Log On To All Workstations

 Users May Log On To These Workstations

 Boxes 1 through 8

See Also

Managing Logon Workstations


Account Information (on a Server) dialog box
Account Information

Use the Account Information dialog box to specify an account expiration date (if any) and the account type for this user account.  For more information, choose one of the following buttons.

 User

 Account Expires

 Never

 End Of

 Account Type

 Global Account

 Local Account

See Also

Managing Account Information


Account Expires

When an account has an expiration date, the account is disabled at the end of that day.  When an account expires, a user who is logged on remains logged on but can establish no new network connections, and after logging off cannot log back on.


Never

If you choose Never, the account will not expire.


End Of

If you choose End Of, you must specify an expiration date in the End Of box.  The account becomes disabled at the end of the specified day.


Account Type

User accounts are either global or local accounts. Most accounts are global accounts.

A global account is a normal user account in the user's home domain. A local account is an account provided in this domain for a user whose global account is not in a trusted domain.


Global Account

A global account is a normal user account in the user's home domain. Most accounts are global accounts (and this is the default). If there are multiple domains available, it is best if each user in the network has only one global account in only one domain, so that there is only one password for the user.

In the User Manager window, global accounts are represented by the global account icon.


Local Account

A local account is an account provided in this domain for a user whose regular account is not in a trusted domain. This might be a Windows NT Server domain that is not trusted by this domain; a LAN Manager domain; or another type of domain or network.

Local accounts can be used to access Windows NT computers over the network, and can be granted resource permissions and user rights.  However, local accounts cannot be used to log on interactively at Windows NT computers.  Local accounts created in one domain cannot be used in trusting domains, and do not appear in the Add Users And Groups dialog boxes of trusting domains.

It is best for local accounts to use the same password here as they do in their home domain.


Administrator

The user can perform all actions on the server.

Always assign a password to a user account that is granted the Administrator privilege level.


User

The user can employ network resources (subject to the access permissions for the resources), view information about shared resources, view printer and communication-device queue status, and send and receive messages.  The user account is a member of  the special Users group, to which permissions can be assigned.  This is the default privilege level and is granted to most network users.

An account granted the User privilege level can optionally be assigned one or more of the user operator privileges.


Guest

The user has the same abilities as a user granted User privilege, but is a member of the special Guest group instead of the Users group.  To exclude temporary or occasional users from the Users group, give an account Guest privilege.


Account Operator

The user can create, remove, and modify user accounts that have User or Guest privilege; create, remove and modify groups; and modify logon restrictions.

The user cannot modify an account that has Administrator privilege, except to change group memberships.  The user cannot change an account's privilege level to Administrator.


Print Operator

The user can share and stop sharing printer queues; create, remove, and modify printer queues; control print jobs; and view a list of all resources shared on the server, including resources available only to Administrators.


Server Operator

The user can start and stop services; share and stop sharing resources; read and clear the error log; close user sessions and the files users have opened; and view a list of all the resources shared on the server, including resources available only to Administrators.


Comm Operator

The user can share and stop sharing communication device queues; control communication device queue requests; and view a list of all resources shared on the server, including resources available only to Administrators.


Account Information (on LAN Manager) dialog box
Account Information

Use the Account Information dialog box to specify an account expiration date (if any), and the privilege level for this user account.  For more information, choose one of the following buttons.

 User

 Account Expires

 Never

 End Of

 Administrator

 User

 Guest

 Account Operator

 Print Operator

 Server Operator

 Comm Operator

See Also

Managing Account Information


Account Information

Use the Account Information dialog box to specify an account expiration date (if any) and the account type for all the selected user accounts.  For more information, choose one of the following buttons.

 Users

 Account Expires

 Never

 End Of

 Account Type

 Global Account

 Local Account

See Also

Managing Account Information


Account Information

Use the Account Information dialog box to specify an account expiration date (if any), and the privilege level for all the selected user accounts.  For more information, choose one of the following buttons.

 Users

 Account Expires

 Never

 End Of

 Administrator

 User

 Guest

 Account Operator

 Print Operator

 Server Operator

 Comm Operator


Rename User dialog box
Rename User

Use the Rename dialog box to change the user name assigned to an existing user account.  A user name cannot be identical to any other user or group name of the domain or computer being administered.  It can contain any uppercase or lowercase characters except for the following:

"  /  \  [  ]  :  ;  |  =  ,  +  *  ?  <  >

Change To

To change the user name, in the Change To box type a new user name of up to 20 characters, and then choose the OK button.

See Also

Renaming User Accounts


Delete Multiple Users dialog box
Delete Multiple Users

Use the Delete Multiple Users dialog box to delete user accounts.  User accounts that have been created using User Manager for Domains can be deleted, but the built-in Administrator and Guest accounts cannot.

For more information, choose one of the following buttons.

 Delete User

 Yes

 Yes to All

 No

See Also

Disabling User Accounts

Deleting User Accounts


Delete User

The name of the account that will be deleted if you choose the Yes button.  Only one user name is shown, even though two or more were selected in the User Manager for Domains window.


Yes button

To delete the user account named in the Delete User field, choose the Yes button.


Yes To All button

To delete all the user accounts that were selected in the User Manager for Domains window, choose the Yes To All button.


No button

To skip deletion of the user account named in the Delete User field, choose the No button.

That user account is removed from the list of user accounts selected for deletion.  The next user account selected for deletion is displayed in the Delete User field.


Select Users dialog box
Select Users

Use the Select Users dialog box to select and deselect the user account membership of groups.

However, only user accounts from the domain or computer being administered (those listed in the User Manager for Domains window) can be selected or deselected.  For example, if you are administering a domain and you issue the Select button against a local group, member user accounts from trusted domains are not affected.

Once the accounts are selected, a command from the User menu can be issued against the selected user accounts.  For more information, choose one of the following buttons.

 Group

 Select button

 Deselect button

See Also

Selecting User Accounts


Group

The group box lists the groups of the domain or computer being administered.


Select button

To select all the user accounts that are members of a particular group, select the group from the Group box, and then choose Select.

However, only user accounts from the domain or computer being administered (those user accounts listed in the User Manager for Domains window) can be selected.  For example, if you are administering a domain and you issue the Select button against a local group, member user accounts from trusted domains are not affected.


Deselect button

To deselect all the user accounts that are members of a particular group, select the group from the Group box, and then choose Deselect.

However, only user accounts from the domain or computer being administered (those user accounts listed in the User Manager for Domains window) can be deselected.  For example, if you are administering a domain and you issue the Deselect button against a local group, member user accounts from trusted domains are not affected.


Global Group (on a Server) dialog box
Global Group

Use the Global Group dialog box to create, copy, or modify a global group.  For more information, choose one of the following buttons.

 Group Name

 Description

 Members

 Not Members

 Add button

 Remove button

See Also

Creating a New Global Group

Copying a Global Group

Managing Global Group Properties


Group Name

The group name identifies the global group.  A group name cannot be identical to any other group or user name of the domain or computer being administered.  It can contain any uppercase or lowercase characters except for the following:

"  /  \  [  ]  :  ;  |  =  ,  +  *  ?  <  >

The name of an existing group cannot be changed.

When creating a new global group or copying an existing global group, type a group name of up to 20 characters in the Group Name box.


Description

To enter or change the group description, type new text in the Description box.


Members

The Members box lists the members of the global group.  User accounts from this domain can be members.

If you are creating a new global group, and if you selected one or more user accounts in the User Manager for Domains window before choosing New Global Group from the User menu, those accounts become the initial membership of the group and are listed in the Members box.

If you are copying a global group, the list in the Members box is copied from that global group.

If you are modifying an existing global group, the Members box shows the current members of the group.


Not Members

The Not Members box lists the user accounts of this domain that are not members of the global group.


Add button

To add members to this group, select one or more user accounts in the Not Members box, and then choose the Add button.

Or, select one or more user accounts in the Not Members box, and then drag one of the selected user account icons into the Members box.


Remove button

To remove members from this group, select one or more user accounts in the Members box, and then choose the Remove button.

Or, select one or more user accounts in the Members box, and then drag one of the selected user account icons into the Not Members box.


Global Group (on LAN Manager) dialog box
Global Group

Use the Global Group dialog box to create, copy, or modify a global group.  For more information, choose one of the following buttons.

 Group Name

 Description

 Members

 Not Members

 Add button

 Remove button

See Also

Creating a New Global Group

Copying a Global Group

Managing Global Group Properties


Local Group (on a Server) dialog box
Local Group

Use the Local Group dialog box to create, copy, or modify a local group.  For more information, choose one of the following buttons.

 Group Name

 Description

 Show Full Names button

 Members

 Add button

 Remove button

See Also

Creating a New Local Group

Copying a Local Group

Managing Local Group Properties


Group Name

The group name identifies the local group.  A group name cannot be identical to any other group or user name of the domain or computer being administered.  It can contain any uppercase or lowercase characters except for the following:

"  /  \  [  ]  :  ;  |  =  ,  +  *  ?  <  >

The name of an existing group cannot be changed.

When creating a new local group or copying an existing local group, type a name in the Group Name box.


Description

To enter or change the group description, type new text in the Description box.


Show Full Names button

The user accounts listed in the Members box are identified only by the user names.  To also display the full names, choose Show Full Names.

This can be a lengthy operation when the local group contains numerous users from other domains.


Members

The Members box lists the members of the local group.  User accounts and global groups from this domain and trusted domains can be members.

If you are creating a new local group, and if you selected one or more user accounts in the User Manager for Domains window before choosing New Local Group from the User menu, those accounts become the initial membership of the group and are listed in the Members box.

If you are copying a local group, the list in the Members box is copied from that local group.

If you are modifying an existing local group, the Members box shows the current members of the group.


Members

The Members box lists the members of the local group.  User accounts from this workstation can be members.  If this workstation participates in a domain, user accounts and global groups from the local domain and trusted domains can also be members.

If one or more user accounts are selected in the User Manager for Domains window when you choose New Local Group from the User menu, those accounts become the initial membership of the group and are listed in the Members box.

If you are copying a local group, the list in the Members box is copied from that local group.

If you are modifying an existing local group, the Members box shows the current members of the group.


Add button

To add members to this local group, choose the Add button, and complete the Add Users And Groups dialog box that appears.  User accounts and global groups from this domain and trusted domains can be added.


Add button

To add members to this local group, choose the Add button and complete the Add Users And Groups dialog box that appears.

User accounts from this workstation can be added to the group.  If this workstation participates in a domain, user accounts and global groups from the local domain and trusted domains can also be added.


Remove button

To remove members from this local group, select one or more names from the Members box, and then choose the Remove button.


Local Group (on a Workstation) dialog box
Local Group

Use the Local Group dialog box to create, copy, or modify a local group.  For more information, choose one of the following buttons.

 Group Name

 Description

 Show Full Names button

 Members

 Add button

 Remove button

See Also

Creating a New Local Group

Copying a Local Group

Managing Local Group Properties


Account Policy (on a Server) dialog box
Account Policy

Use the Account Policy dialog box to control how passwords must be used by all user accounts, and whether user accounts are automatically locked out after a series of incorrect logon attempts.  For more information, choose one of the following buttons.

 Domain

 Maximum Password Age

 Minimum Password Age

 Minimum Password Length

 Password Uniqueness

 No Account Lockout

 Account Lockout

 Forcibly Disconnect Remote Users From Server When Logon Hours Expire

 Users Must Log On In Order To Change Password

See Also

Managing the Account Policy


Domain

The name of the domain or computer being administered.


Computer

The name of the computer being administered.


Maximum Password Age

The period of time a password can be used before the system requires the user to change it.

Enter a value between 1 and 999 days, or select Password Never Expires.


Minimum Password Age

The period of time a password must be used before the user can change it. Do not allow immediate changes if a Password Uniqueness value is entered.

Enter a value between 1 and 999 days, or select Allow Changes Immediately.


Minimum Password Length

The fewest characters a password can contain.

Enter a value between 1 and 14 characters, or select Permit Blank Password.


Password Uniqueness

The number of new passwords that must be used by a user account before an old password can be reused. For uniqueness to be effective, immediate changes should not be allowed under Minimum Password Age.

Enter a value between 1 and 8 passwords, or select Do Not Keep Password History.


No Account Lockout

If this option is selected, user accounts are never locked out, no matter how many incorrect logon attempts are made on a user account.


Account Lockout

If this option is selected, all user accounts are subject to lockout. If too many incorrect logon attempts are made on a user account, with no more than a specified amount of time between any two of the logon attempts, the account is locked out. A locked account cannot log on.

If you select Account Lockout, you should also do the following:

In Lockout After, specify the number of incorrect logon attempts that will cause the account to be locked. The range is 1 to 999.

In Reset Count After, specify the maximum number of minutes that can occur between any two bad logon attempts for lockout to occur. The range is 1 to 99999.

In Lockout Duration, select Forever to cause locked accounts to remain locked until an administrator unlocks them. Or select Duration and type a number of minutes for locked accounts to remain locked before automatically becoming unlocked. The range is 1 to 99999.


Forcibly Disconnect Remote Users From Server When Logon Hours Expire

If this option is selected, when a user account exceeds its logon hours it is disconnected from all connections to any server in the domain.

If this option is cleared, the user account is not disconnected, but no new connections are allowed.

This option interacts with the Logon Hours defined for a user account.


Users Must Log On In Order to Change Password

If this option is selected, users must log on before changing their password. If a user's password expires, the user will not be able to change the expired password, but instead must have an administrator change the password.

If this option is cleared, users will be able to change their expired passwords without notifying an administrator.


Account Policy (on a Workstation) dialog box
Account Policy

Use the Account Policy dialog box to control how passwords must be used by all user accounts of the workstation.  For more information, choose one of the following buttons.

 Computer

 Maximum Password Age

 Minimum Password Age

 Minimum Password Length

 Password Uniqueness

 No Account Lockout

 Account Lockout

 Forcibly Disconnect Remote Users From Server When Logon Hours Expire

 Users Must Log On In Order To Change Password

See Also

Managing the Account Policy


Account Policy (on LAN Manager) dialog box
Account Policy

Use the Account Policy dialog box to control how passwords must be used by all user accounts.  For more information, choose one of the following buttons.

 Domain

 Maximum Password Age

 Minimum Password Age

 Minimum Password Length

 Password Uniqueness

 Forcibly Disconnect Remote Users From Server When Logon Hours Expire

 Users Must Log On In Order To Change Password

See Also

Managing the Account Policy


User Rights Policy (on a Server) dialog box
User Rights Policy

The User Rights policy manages the rights granted to groups and user accounts.

A right authorizes a user to perform certain actions on the system. A user who logs on to an account to which the appropriate rights have been granted can carry out the corresponding actions. When a user does not have appropriate rights, Windows NT blocks attempts to carry out those actions.  Rights apply to the system as a whole and are different from permissions, which apply to specific objects.

The rights granted to a group are provided to the members of that group.  In most situations, the easiest way to provide rights to a user is to add that user's account to one of the built-in groups that already possesses the needed rights, rather than by administering the User Rights policy.

For information about the User Rights Policy dialog box, choose one of the following buttons.

 Domain

 Right

 Grant To

 Show Advanced User Rights

 Add button

 Remove button

See Also

The User Rights

Managing the User Rights Policy


Right

The Right box contains a list of the available rights, and displays the selected right.

To manage a right, select a right from the Right list box.

The list of groups and user accounts granted that right can then be viewed, and names can be added to or removed from the list.


Grant To

The Grant To box lists the groups and user accounts that are assigned the right that is selected in the Right list box.


Show Advanced User Rights

In addition to the user rights listed by default in the Right box, if the Show Advanced User Rights option is selected, some additional rights are listed. Most of these advanced rights are useful only to programmers writing applications to run with Windows NT.

To also administer the advanced user rights, select the Show Advanced Rights option.


Add button

To grant the selected right to additional groups or user accounts, choose the Add button and complete the Add Users And Groups dialog box that appears.

Groups and user accounts from this domain and from trusted domains can be granted rights.


Add button

To grant the selected right to additional groups or user accounts, choose the Add button and complete the Add Users And Groups dialog box that appears.

Local groups and user accounts from this workstation can be granted rights.  If this workstation participates in a domain, user accounts and global groups from the local domain and trusted domains can also be granted rights.


Remove button

To remove a group or user account from the list of those granted the selected right, select the group or user account in the Grant To box, and then choose the Remove button.


User Rights Policy (on a Workstation) dialog box
User Rights Policy

The User Rights policy manages the rights granted to groups and user accounts.

A right authorizes a user to perform certain actions on the system. A user who logs on to an account to which the appropriate rights have been granted can carry out the corresponding actions. When a user does not have appropriate rights, Windows NT blocks attempts to carry out those actions.  Rights apply to the system as a whole and are different from permissions, which apply to specific objects.

The rights granted to a group are provided to the members of that group.  In most situations, the easiest way to provide rights to a user is to add that user's account to one of the built-in groups that already possesses the needed rights, rather than by administering the User Rights policy.

For information about the User Rights Policy dialog box, choose one of the following buttons.

 Computer

 Right

 Grant To

 Show Advanced User Rights

 Add button

 Remove button

See Also

The User Rights

Managing the User Rights Policy


Audit Policy (on a Server) dialog box
Audit Policy

Windows NT can track selected activities of users, by auditing security events and then placing entries in a computer's security log.  Use the Audit policy to determine the types of security events Windows NT will log.

When administering domains, the Audit policy affects the security logs of the domain controller and of all servers in the domain, because they share the same Audit policy. When administering a Windows NT Workstation computer or a Windows NT Server computer that is not a domain controller, this policy affects only the security log of that computer.

Because the security log is limited in size, carefully choose the events to be logged.  The maximum size of each computer's security log is defined in Event Viewer.  Entries in a security log can be reviewed using Event Viewer.

For more information, choose one of the following buttons.

 Domain

 Do Not Audit

 Audit These Events

 Success

 Failure

 Logon and Logoff

 File and Object Access

 Use of User Rights

 User and Group Management

 Security Policy Changes

 Restart, Shutdown, and System

 Process Tracking

See Also

Managing the Audit Policy


Do Not Audit

No events will be recorded in the security log.


Do Not Audit

No events will be recorded in the security log.


Audit These Events

The selected events will be logged.


Success

If this box is selected, a successful occurrence of the event adds an entry to the security log.


Failure

If this box is selected, a failed attempt or failed occurrence of the event adds an entry to the security log.


Logon and Logoff

A user logged on or off, or made a network connection.


File and Object Access

A user accessed a directory or a file that is set for auditing in File Manager, or a user sent a print job to a printer that is set for auditing in Print Manager.


Use of User Rights

A user exercised a user right (except those rights related to logon and logoff.)


User and Group Management

A user account or group was created, changed, or deleted.  A user account was renamed, disabled, or enabled; or a password was set or changed.


Security Policy Changes

A change was made to the User Rights, Audit, or Trust Relationships policies.


Restart, Shutdown, and System

A user restarted or shut down the computer; or an event has occurred that affects system security, or the security log.


Process Tracking

These events provided detailed tracking information for such events as program activation, some forms of handle duplication, indirect object accesses, and process exit.


Audit Policy (on a Workstation) dialog box
Audit Policy

Windows NT can track selected activities of users, by auditing security events and then placing entries in the computer's security log.  Use the Audit policy to determine the types of security events Windows NT will log.

Because the security log is limited in size, carefully choose the events to be logged.  The maximum size of the computer's security log is defined in Event Viewer.  Entries in a security log can be reviewed using Event Viewer.

For more information, choose one of the following buttons.

 Computer

 Do Not Audit

 Audit These Events

 Success

 Failure

 Logon and Logoff

 File and Object Access

 Use of User Rights

 User and Group Management

 Security Policy Changes

 Restart, Shutdown, and System

 Process Tracking

See Also

Managing the Audit Policy


Audit Policy (on LAN Manager) dialog box
Audit Policy

Selected activities of users can be tracked, by auditing security events and then placing entries in a computer's security log.  Use the Audit policy to determine the types of security events that will be logged.

For more information, choose one of the following buttons.

 Domain

 Do Not Audit

 Audit These Events

 Success

 Failure

 Logon and Logoff

 File and Object Access

 Use of User Rights

 User and Group Management

 Security Policy Changes

 Restart, Shutdown, and System

 Process Tracking

See Also

Managing the Audit Policy


Trust Relationships dialog box
Trust Relationships

Use the Trust Relationships dialog box to add domain names to and remove domain names from the list of domains this domain trusts, and the list of domains that are allowed to trust this domain.  Only Windows NT Server domains can participate in trust relationships.

Establishing a trust relationship requires two steps performed in two different domains:  first one domain must permit a second domain to trust it, and then the second domain must be set to trust the first domain.  Establishing a two-way trust relationship (where each domain trusts the other) requires that both steps be performed in both domains.

Removing a trust relationship also requires two steps performed in two different domains:  one domain must stop trusting a second domain, and the second domain must stop permitting the first domain to trust it.  Never remove a trust relationship by performing just one of the steps.  When removing a trust relationship, always administer both domains.

For more information about this dialog box, choose one of the following buttons.

 Domain

 Trusted Domains

 Permitted to Trust this Domain

 Add buttons

 Remove buttons

See Also

Permitting Another Domain to Trust

Trusting Another Domain


trust relationship

A trust relationship is a link between two Windows NT Server domains, where one domain honors the users of another domain, trusting the logon authentications performed by that other domain for its own users.  User accounts and global groups defined in a trusted domain can be granted rights, resource permissions, and local group memberships at a trusting domain and its member computers, even though those accounts don't exist in the trusting domain's security database.

When trust relationships are properly established between all the domains of a network, they allow a user to have only one user account and one password in one domain, yet to access the entire network.


Trusted Domains

The Trusted Domains box lists the domains that this domain trusts.

Only Windows NT Server domains can be trusted.


Permitted to Trust this Domain

The Permitted To Trust This Domain box lists the domains that are allowed to trust this domain.

Only Windows NT Server domains can be permitted to trust.


Add buttons

Note that establishing a trust relationship requires two steps performed at two different domains:  first one domain must permit a second domain to trust it, and then the second domain must be set to trust the first domain.

To add a new trusted domain, choose the Add button adjacent to the Trusted Domains box, and then complete the Add Trusted Domain dialog box that appears.

To allow a domain to trust this one, choose the Add button adjacent to the Permitted To Trust This Domain box, and then complete the Permit Domain To Trust dialog box that appears.


Remove buttons

Removing a trust relationship requires two steps performed in two different domains:  one domain must stop trusting a second domain, and the second domain must stop permitting the first domain to trust it.  Never remove a trust relationship by performing just one of the steps.  When removing a trust relationship, always administer both domains.

To stop trusting a domain, select a domain from the Trusted Domains box, and then choose the Remove button.

To stop allowing a domain to trust this one, select a domain from the Permitted To Trust This Domain box, and then choose the Remove button.


Add Trusted Domain dialog box
Add Trusted Domain

Use the Add Trusted Domain dialog box to add a Windows NT Server domain to this domain's list of trusted domains.

Domain

Type the name of the domain to be trusted.

You can type a name using both uppercase and lowercase characters, but the name is always displayed in uppercase.

Password

Type the password required by the trusting domain.  This is the same password that was entered in the Permit Domain to Trust dialog box for that domain.

Passwords are case sensitive.  Windows NT distinguishes between uppercase and lowercase characters in passwords.

Note:  Once a trust relationship is established, the system changes this password.  Because of this, you cannot remove one side of an established trust relationship, and then later reestablish that trust using the original password.  You must always remove both sides of a trust relationship, and then completely reestablish it.

See Also

Permitting Another Domain to Trust

Trusting Another Domain


Permit Domain to Trust dialog box
Permit Domain to Trust

Use the Permit Domain To Trust dialog box to add a Windows NT Server domain to the list of domains that are allowed to trust this domain.

Domain to Permit

Type the name of the domain that will be permitted to trust this domain.

You can type a name using both uppercase and lowercase characters, but the name is always displayed in uppercase.

Initial Password and Confirm Password

Type the same password in these boxes.

Passwords are case sensitive.  Windows NT distinguishes between uppercase and lowercase characters in passwords.

Note:  Once a trust relationship is established, the system changes this password.  Because of this, you cannot remove one side of an established trust relationship, and then later reestablish that trust using the original password.  You must always remove both sides of a trust relationship, and then completely reestablish it.

See Also

Permitting Another Domain to Trust

Trusting Another Domain


Select Domain dialog box
Select Domain

When User Manager for Domains starts, it displays the domain where your user account is defined.  Use the Select Domain command to display a different domain.

Optionally, you can display an individual computer, but you can only display a computer that maintains its own security database, such as a Windows NT Workstation computer, a Windows NT Server computer that is not a domain controller, or a Microsoft LAN Manager server.  If you specify a primary or backup domain controller, the domain is displayed instead.

For more information, choose one of the following buttons.

 Domain

 Select Domain

 Low Speed Connection

See Also

Selecting a Domain

Using Low Speed Connection


Domain

To display a domain, type the domainname in the Domain box and then choose the OK button.  To display only one computer, type the \\computername (precede computer names with two backslashes) and then choose the OK button.

You can type a name using both uppercase and lowercase characters, but the name is always displayed in uppercase.


Select Domain

To display one of the listed domains, select that domain name from the Select Domain list and then choose the OK button.


Low Speed Connection

When administering a domain or computer that communicates with your computer across a connection providing relatively low transmission rates, some User Manager for Domains functions may be performed slowly. In this situation, you can reduce delays by using the Low Speed Connection option.  Choosing Low Speed Connection prevents the lists of users and groups from being displayed, but still allows you to administer users and local groups (but not global groups).

For example, from a Windows NT Server you might administer a remote Windows NT Workstation computer that is running the Microsoft Windows NT Remote Access Service and is connected to the network by a modem over telephone lines.  When entering the computer name in User Manager for Domain's Select Domain dialog box, you should select the Low Speed Connection option.

The Low Speed Connection option can also be selected or cleared by choosing Low Speed Connection from the Options menu.


Add Users and Groups dialog box
Add Users and Groups

Use the Add Users And Groups dialog box to grant the selected right to groups and user accounts.  Groups and user accounts from the local domain and trusted domains can be granted rights.  For more information, choose one of the following buttons.

 List Names From

 Names

 Add button

 Show Users button

 Members button

 Search button

 Add Names


List Names From

The List Names From box contains a list of domain and computer names, and displays the selected name.

When an asterisk (*) appears next to a domain or computer name in the List Names From box, it indicates that the local groups of that domain or computer can be listed in the Names box.  When the asterisk is absent, it indicates that local groups cannot be listed.

To change the selected domain or computer, select a name from the list in the List Names From box.


Names

Lists the groups of the domain or computer selected in the List Names From box.  If the Show Users button has been selected, also lists the user accounts.


Names

Lists the user accounts of the domain or computer selected in the List Names From box.  If a domain is selected, global groups are also listed.


Add button

To enter names in the Add Names box, select one or more names from the Names box, and then choose the Add button.


Show Users button

By default, only groups are listed in the Names box.

To also show user accounts in the Names box, choose the Show Users button.


Members button

To see the members of a group, select the group from the Names list, and then choose the Members button.


Search button

To search for a particular group or user account, choose the Search button and complete the Find Account dialog box that appears.


Add Names

Groups and user accounts can be added to this box by typing their names (separated by semicolons) in the box; by selecting them from the Names box and then choosing the Add button; by choosing the Search button and then completing the Find Account dialog box that appears; or by selecting a group from the Names box, choosing the Members button, and then completing the Group Membership dialog box that appears.

To grant the selected right to the names in the Add Names box, choose the OK button.


Add Names

Groups and user accounts can be added to this box by typing their names (separated by semicolons) in the box; by selecting them from the Names box and then choosing the Add button; by choosing the Search button and then completing the Find Account dialog box that appears; or by selecting a global group from the Names box, choosing the Members button, and then completing the Group Membership dialog box that appears.

To give the names in the Add Names box membership in the selected local group, choose the OK button.


Add Users and Groups dialog box
Add Users and Groups

Use the Add Users And Groups dialog box to add members to the local group.  For more information, choose one of the following buttons.

 List Names From

 Names

 Add button

 Members button

 Search button

 Add Names


Local Group Membership dialog box
Local Group Membership

The Local Group Membership dialog box lists the user accounts and global groups that are members of the selected local group.  For more information, choose one of the following buttons.

 Members of Local Group

 Add button

 Members button


Members Of Local Group

The members of the selected local group are listed in this box.


Add button

To add user accounts or global groups to the Add Names box in the Add Users And Groups dialog box, select one or more names from the Members Of list here in the Local Group Membership dialog box, and then choose the Add button.


Members button

To see the members of a global group (that is itself a member of this local group), select the global group from the Members Of list, and then choose the Members button.


Global Group Membership dialog box
Global Group Membership

The Global Group Membership dialog box lists the user accounts that are members of the selected global group.

Members of Global Group

The members of the selected global group are listed here.

Add Button

To add user accounts to the Add Names box in the Add Users And Groups dialog box, select one or more names from the Members Of list here in the Global Group Membership dialog box, and then choose the Add button.


Find Account dialog box
Find Account

Use the Find Account dialog box to locate a user account or group.  For more information, choose one of the following buttons.

 Find User or Group

 Search All

 Search Only In

 Search button

 Search Results

 Add button


Find User or Group

In this box, type the name you want to search for.

The system will search only for user accounts or groups of that exact name.


Search All

When selected, this option causes the search to look for a matching user or group name in the local domain or computer, and in all domains trusted by the local domain.


Search Only In

When selected, this option causes the search to look for a matching user or group name only in the domains and computers you have selected from the list.

The list includes the local domain or computer, and all domains trusted by the local domain.


Search button

Begins a search based on the parameters specified in the Find User Or Group box, and by the Search All or Search Only In options.


Search Results

Contains a list of user accounts and groups found during a search.  This list is continuously filled as a search progresses.

One or more names can be selected from the Search Results list, and then added to the Add Names list of the Add Users And Groups dialog box by choosing the Add button here in the Find Account dialog box.

The list presents the matching users in the form domainname\username (full name) description or computername\username (full name) description.

The list presents the matching groups in the form domainname\groupname description or computername\groupname description.


Add button

Closes the Find Account dialog box, and adds the accounts selected in the Search Results list to the Add Names list of the Add Users And Groups dialog box.


Enter Server dialog box
Enter Server

The domain could not be found.  It may not exist, or you may have misspelled the domain name, or the domain may be located across a network bridge.

Note:  Broadcast messages such as the one generated by Add Trusted Domain are not usually passed across wide area network (WAN) bridges.

If you misspelled the domain name

Choose the Cancel button, and then in the Add Trusted Domain dialog box type the correct domain name.

If the domain is located across a network bridge

In the Server box, type the computer name of any server running Windows NT Server in that domain, and then choose the OK button.


Copy User or Group

Use this dialog box to select a user account or local group for copying.  (In Low Network Connection mode, global groups cannot be copied.)

Enter user name or local group name

To select a user account or group for copying, type a user name or local group name in this box, and then choose the OK button.

See Also

Using Low Speed Connection


Delete User or Group

Use this dialog box to select a user account, local group, or global group for deletion.

Enter user name or group name

To select one user account, one global group, or one local group for deletion, type its name in this box, and then choose the OK button.

To select multiple user accounts for deletion, type the user names in this box, separated by semicolons, and then choose the OK button.

See Also

Using Low Speed Connection


Manage User or Group Properties

Use this dialog box to select a user account or local group for administration.  (In Low Speed Connection mode, global groups cannot be administered.)

Enter user name or local group name

To select one user account or one local group for administration, type its name in this box, and then choose the OK button.

To select multiple user accounts for administration, type the user names in this box, separated by semicolons, and then choose the OK button.

See Also

Using Low Speed Connection


Rename User

Use this dialog box to select a user account for renaming.  (Groups cannot be renamed.)

Enter user name

To select a user account for renaming, type the user name in this box, and then choose the OK button.

See Also

Using Low Speed Connection


About the User Profile Path

A user profile is a special file that is loaded by the system during a user's logon and defines the Windows NT environment that is created for that user.  This definition includes all the user-specific settings of a user's Windows NT environment, such as Program Manager groups and the program items in those groups, screen colors, network connections, printer connections, mouse settings, window size and position, and more.

Each Windows NT computer maintains a default user profile.  If a user account does not have a user profile assigned, at the first logon to that account from a Windows NT computer, that computer's default user profile is loaded.  A copy of this profile is saved, along with any changes the user makes to the Windows NT environment.  At all subsequent logons from that computer, the user's copy of the profile is loaded.  In this way a user's Windows NT configuration is saved from one session to the next.  However, a different user profile is saved at each Windows NT computer the user logs on from.

Optionally, you can create user profiles with User Profile Editor and save them in shared network directories.  With User Manager for Domains, you can assign these user profiles to user accounts.  Using user profiles you have created differs in several ways from using a computer's default user profile:

A user can move between various Windows NT computers in the network, yet still receive a consistent Windows NT environment.  Since the user profile is stored in a network directory, it can be loaded no matter which Windows NT computer the user logs on from.

If appropriate, a single user profile can be assigned to a group of users who perform similar tasks.  In this way a common configuration can be shared by multiple users.

If appropriate, an administrator can use the user profile to restrict a user's access and capabilities, by using options provided by User Profile Editor.

There are two types of user profiles that can be assigned to user accounts:

Personal user profiles.  Each must be assigned to only one user. A personal user profile retains any changes the user makes to the Windows NT environment.   At every logon, the user receives the newest version of his or her environment. Filenames of personal user profiles end in the .USR filename extension.

Mandatory user profiles.  These can be assigned to any number of users. A mandatory user profile permanently defines the user's Windows NT environment, so that the original, unmodified settings are always loaded at every logon.  Filenames of mandatory user profiles end in the .MAN filename extension.

You assign user profiles to user accounts by specifying a full pathname in User Manager for Domains.  Here are some examples:

You might assign one mandatory profile to one or more user accounts by specifying, for example, a user profile path of \\AIREDALE\CLERKS\CLERKS.MAN.

You might assign a personal profile to one user account by specifying, for example, a user profile path of \\WOLFHOUND\ACCOUNTS\JEFFHO.USR.

You might assign separate personal profiles to multiple user accounts by specifying, for example, a user profile path of \\CAT\PROFILES\%USERNAME%.USR.

After a user profile path is assigned to a user account, it may or may not be necessary to create the specified user profile and place it in the specified network directory.

If you assign a mandatory user profile to a user account, you must create a profile of that name and place it in the specified network directory.  At logon, if the assigned mandatory user profile is not found, the logon attempt is denied.

If you assign a personal user profile to a user account, you can optionally create a profile of that name and place it in the specified network directory.  It is loaded every time the user logs on.

However, if a personal user profile of that name is not created, then at the user's first logon to that account, the system copies the default user profile from the user's logon computer and saves it under the specified filename in the specified network directory.  This allows you to assign personal user profiles to many user accounts with User Manager for Domains, without the need to individually create each personal user profile with User Profile Editor.

See Also

Managing Profiles