Board - Overview
=> Not registered yet?
Logon rights control how security principals are allowed access to the computer—whether from the keyboard or through a network connection, or whether as a service or as a batch job. For each logon method, there exists a pair of logon rights—one to allow logging on to the computer and another to deny logging on to the computer. Use a deny logon right as you would use a deny permission—to exclude a subset of a group that has been assigned an allow logon right. For example, suppose that Alice wants all users except the members of the domain Marketing group to be able to log on locally at her computer’s keyboard. With this in mind, Alice creates a local group, which she names “LocalLogonDenied.” Then she configures her computer as follows:
She assigns the log on locally user right to the Users group.
She assigns the deny local logon user right to the LocalLogonDenied group.
She makes the Marketing group a member of the LocalLogonDenied group.
Deny rights take precedence over allow rights, so members of the Marketing group are denied the right to log on locally even though they are also members of the Users group, which is allowed to log on locally.
Warning The rule to keep in mind is: “Allow a set, and then deny a subset.” Reversing the order can be disastrous. For example, Alice might want to allow no one but herself to log on locally. If she allowed herself the right to log on locally and denied the Users group the right to log on locally, she would be unpleasantly surprised to find that she had locked herself out of the computer. Alice, after all, is a member of the Users group, so the deny right she assigned to the Users group would take precedence over the allow right she assigned to herself.
Logon rights are described in Table B-1. The display names for logon rights are followed by the string constant (in parentheses). Many command-line tools refer to rights by string constant rather than by display name. The default settings are taken from the Windows XP Professional Local Computer policy. | Category | Posts | Last post made by | Example-Board
You can edit or delete this Board at Manage rnextras=>Board=>Manage categorys | 1 | Benjamin Lochmann
03/15/2011 at 8:28am (UTC) | paisalive
log and start earning money | 0 | - |
Total topics: 1 Total posts: 1 Total users: 2 Online now (registered users): Nobody  |
