Windows Vista: The Complete Reference (Complete Reference Series)

What Is a User Account?

When two or more users share a computer, they don't have to argue about what color the background should be, what programs should be on the Start menu, or whether to use single-click or double-click style. Instead, each user can have a user account (called a user profile in versions of Windows prior to Windows XP). User accounts can be stored in one of two places:

• Local user accounts Information about a local user account is stored r in the C:\ Users folder that contains files that describe each user's preferences. Each time a user logs on, Windows finds the appropriate user account and makes the appropriate changes. If you change any of your preferences (for example, choose a new wallpaper), that information is stored in your user account, so that the change will still be there the next time you log on, but not the next time someone else logs on. Whenever your computer acquires a new user, you should establish a new user account (see "Setting Up a Computer for Multiple Users" later in the chapter). User accounts enable several people to share one computer, or to share folders and other resources on a LAN.

• Domain accounts Information about domain accounts is stored by the Active Directory (AD) program running on Windows NT, 2000, .NET Server, or Windows 2003 Server. When you log in using a domain, your computer gets information from Active Directory about what your settings are and what you have permission to do. Domain accounts are used on larger networks where maintaining accounts stored in each individual computer would be impractical . Domain accounts can use roaming user profiles , which allow people to use their own user account from any computer on a LAN, or mandatory user profiles , in which only administrators can make changes.

Windows Vista enables you to password-protect the files in your Documents folder, so that other people using the same computer later won't be able to read them (see "Keeping Your Files Private"). Each user's Documents folder can be protected from view from the other users.

Another feature protects your computer if you don't assign passwords to your user accounts. If your user account doesn't have a password, you can log on to your account only at your own computer; you can't use Run As (described in "Running a Program as Another User" later in this chapter) or Remote Desktop Connection to use the computer with your user account (see "Accessing Other Computers with Remote Desktop Connection" in Chapter 16).

If your computer is on a small LAN, you can set up local user accounts on all the computers on the LAN so that people can use any computer and see their own files and desktop. See Chapter 31 for details.

User Account Control when Starting Programs

User Account Control (UAC) is a new technology provided in Windows Vista. It enables users and organizations to better secure desktop environments against potential security breaches and malicious threats. UAC also provides a better way to manage desktops in an enterprise environment. UAC enables you to allow a nonadministrator to log in as an administrator with limited rights and access. When a user logs into Vista using an administrator account, the account is "split" into two accounts-administrator and standard user. As the user is performing nonadministrator tasks, such as running applications, using items on the desktop, and so forth, a user token is created. When an administrator task is performed, such as installing a program, Vista creates a second token, an administrator token, so the user can perform those tasks . The user is required to click a Continue button to allow the action to happen. This reduces the amount of security problems that previous versions of Windows had when a user could log in as an administrator and perform any task without restrictions.

When a standard user logs into Vista, only one type of token is created-a standard user token. This restricts the user from performing system-wide changes to the computer. A standard user trying to perform an administrator-level task is required to sign on with a username and password for a valid administrator account.

Vista segregates tasks into administrator and standard user tasks. For example, the following are tasks that are administrator level:

• Installing programs

• Changing system times

• Changing firewall settings

• Configuring security policies

• Accessing some Control Panel applets

On the other hand, the following tasks are standard user-level tasks:

• Changing desktop wallpaper

• Adding a printer

• Changing time zones

Vista displays the Windows Shield icon on user interface items, such as a button on a dialog box, to indicate UAC items.

Vista automatically turns on User Account Control when you install Vista. You can, however, turn it off if you determine you do not need the level of security it provides. For example, a home user that is using Vista in a nonnetworked or nonshared environment would probably not require UAC turned on. However, to turn off UAC, you do need administrator privileges, so a user in a corporate environment would probably not have the rights to shut off UAC.

To quickly turn off UAC for an account, do the following:

1. Choose Start Control Panel.

2. Click User Accounts And Family Safety.

3. Click User Accounts.

4. Click Change Security Settings. The User Account Control message window appears, as shown in Figure 6-1.

   Figure 6-1: The User Account Control window

5. Click Continue.

6. Click to deselect the Use User Account Control (UAC) To Help Protect Your Computer option.

7. Click OK.

8. Click Restart to shut down and restart Windows. When Windows restarts, the UAC feature is turned off.

To enable UAC, use the preceding steps, except click to select the option in Step 6. You will need to shut down and restart the system to activate the UAC feature.

UAC is an advanced technology that can be configured in a number of different ways. The way just described is one way, albeit simple and per user-the changes you make are only for the currently logged-in user. For computer-wide changes to UAC, you must use the Security Policy tool, available from the Administrative Tools section of the Control Panel. However, using the Security Policy tool is something most end users will not have to bother with.

What Types of Users Can You Create?

Windows Vista enables you to set up local user accounts. If you are logged into a Windows 2003 Server, Windows .NET, 2000, or NT server with administrative privileges, you can create and maintain domain accounts on a domain-based LAN, but you should talk to your LAN administrator before doing so.

Table 6-1 lists and briefly explains the types of users Vista can have.

You can create as many administrator or standard accounts as you want. You can't create guest accounts.

Table 6-2 lists some of the files and folders that are stored separately for each local user account. These items are stored in the user account's user profile -the folder that contains all the settings for the user. A user profile is usually in the C:\Users\username folder, where username is replaced by the name of the user account. (If Windows is installed on a partition other than C:, so is this folder.) You need to configure Windows Explorer to display hidden files and folders to see them (see "What Are Hidden Files and Folders?" in Chapter 9).

Fast User Switching allows you to switch from one user account to another without the first user logging off. For example, suppose that a user named Jordan is running Windows Mail and Microsoft Office Access 2007. Another user, named Meg, needs to check her mail and asks Jordan if she can use his computer to do so. Fast User Switching lets Jordan step aside and Meg switch the computer to her user account. Jordan's programs are on hold until Meg is done using the computer. When Jordan switches back to his account, his programs are just where he left them.

Fast User Switching is enabled by default if your Windows system has at least 64MB of RAM. With less RAM, the system doesn't have enough space to store one user's environment, including its running programs and open files, while another user is active.