Configuring Windows 7 (Training Kit) - Part 53 potx

Credential Manager stores user name and password data in the Windows Vault.. In the Add a Windows Credential dialog box, shown in Figure 9-12, enter the Internet or network address, user

Lesson 2: Windows 7 authentication

and authorization

When a user forgets his password, he is unable to log on to his computer If he cannot log on

to his computer, he cannot do his job In this lesson, you learn about the methods Windows 7

provides through which you can deal with a forgotten password, from the preventative

creation of a password reset disk to having a member of the Administrators local group log

on and reset the password Passwords are not the only way that you can authenticate to

a client running Windows 7 Windows 7 supports multifactor authentication, primarily by

including drivers that support the Personal Identity Verification (PIV) smart card standard

and policies that can require a smart card to log on In this lesson, you also learn about a new

feature named Credential Manager Credential Manager allows you to back up, restore, and

manage saved credentials, such as those for Web sites and terminal services servers You also

learn about assigning user rights and configuring password policies

After this lesson, you will be able to:

n Back up and restore credentials with Credential Manager

n Administer certificates with Certificate Manager

n Use runas to run commands with alternate credentials

n Configure account and smart card policies

n Resolve authentication issues

Estimated lesson time: 40 minutes

Credential Manager

Credential Manager stores logon user name and passwords for network resources, including

file servers, Web sites, and terminal services servers Credential Manager stores user name

and password data in the Windows Vault You can back up the Windows Vault and restore it

on other computers running Windows 7 as a method of transferring saved credentials from

one computer to another Although Credential Manager can be used to back up some forms

of digital certificates, it cannot be used to back up and restore the self-signed Encrypting File

System (EFS) certificates that Windows 7 generates automatically when you encrypt a file For

this reason, you must back up EFS certificates using other tools You will learn about backing

up EFS certificates later in this lesson

As Figure 9-11 shows, it is possible to add credentials to the Windows Vault by selecting

Remember My Credentials in the Windows Security dialog box Whenever you choose to

remember your credentials, using Windows Internet Explorer, Windows Explorer, or Remote

Desktop Connection, Credential Manager transfers them to the Windows Vault

FIgUre 9-11 Remember My Credentials

You can also preemptively add credentials to Windows Vault for resources prior to actually accessing them To add credentials to the Windows Vault, perform the following steps:

1. Open Credential Manager by typing Credential Manager into the Search Programs

And Files text box and then clicking Credential Manager on the Start menu

2 Click the Add a Windows Credential item

3 In the Add a Windows Credential dialog box, shown in Figure 9-12, enter the Internet

or network address, user name, and password of the credential that you want stored in the Windows Vault

FIgUre 9-12 Adding a Windows Credential

To modify an existing password or to remove an existing credential, click the credential within Credential Manager and then click either the Edit item or the Remove From Vault item, respectively You can see these items in Figure 9-13 Clicking Edit allows you to modify the

user name and password stored in the vault You would use the edit functionality to update

an existing stored password It is important to note that the existing password is not displayed

but is shown as a series of dots You cannot use Credential Manager to determine what an

existing stored password is—only that the password itself is stored

FIgUre 9-13 Editing and removing credentials

You can use the Back Up Vault and Restore Vault items, shown in Figure 9-13, to back up

and restore credential data, or to transfer credential data between computers This can be

especially useful if a user has a significant number of credentials stored on their computer

running Windows 7 and does not want to have to re-enter all of them when they move to

a new computer The backup process involves pressing the Ctrl, Alt, and Del keys at the same

time to enter the backup password to protect the credentials on the Secure Desktop You

must also press Ctrl, Alt, and Del keys to enter the password on the Secure Desktop that you

assigned to the backup when restoring the Windows Vault You will back up and restore the

Windows Vault in the practice at the end of this lesson

Using Runas to Run Programs as Another User

The Runas command-line utility enables you to run programs using the credentials of another

user To run the application named Application exe with an option, enclose the application

and the option within quotation marks To run the program application.exe /option as user

Kim_Akers on computer Canberra, issue the command:

Runas /user:Canberra\Kim_Akers "application.exe /option"

When you enter this command, you have to enter the password of the target account Once you have done this, the application runs using the target user’s security context

The default setting loads the target user’s profile You can also use the /profile option to force

the target user’s profile to be loaded When the target user’s profile is loaded, you can access files encrypted to the target user’s account because the EFS certificates are stored with the

user profile data Use the /noprofile option to stop the profile being loaded

The /savecred option allows you to save the credentials of the target user account You have to enter the password the first time you use the /savecred option To access stored credentials with future Runas commands, use the /savecred option and specify the account

name Saved credentials are stored within the Windows Vault and can be managed using

Credential Manager To use runas with the /savecred option, use the command:

Runas /savecred /user:computername\user name "application.exe /option"

You cannot use the Runas command to execute an application that requires elevation

if the target user account is configured to prompt for consent or prompt for credentials You can use the Runas command to execute an application that requires elevation if the target user account is the built-in administrator account The built-in administrator account

is disabled by default, but it can be enabled through Group Policy To run the Local Group Policy Editor console from a standard user account when the built-in administrator account has been enabled using Group Policy, use the command:

runas /user:administrator "mmc gpedit.msc"

You can use the /savecred option to save the local Administrator account credentials so

that they can be used automatically in the future You should be careful when doing this because of the security risk that it poses

Configuring User Rights

You can configure user rights through the Computer Configuration\Windows Settings\ Security Settings\Local Policies\User Rights Assignment node of Group Policy This node contains 44 policies, most of which relate to operating system functions that are unlikely to

be tested on the 70-680 exam Most administrators configure user rights by adding users to specific local groups rather than by modifying specific user rights group policies For example, you can allow a user to back up files and directories by assigning them to the Backup

Operators group rather than by modifying the Back Up Files and Directories policy The same applies to using Remote Desktop You can add a user account to the Remote Desktop Users group, or you can modify the Allow Log On Through Remote Desktop Services policy It is usually easier to add members to the appropriate local groups because it is easier to keep track of which users have been assigned specific rights by examining group membership than

it is to examine Group Policy settings The Windows 7 built-in groups that you can add users

to as a method of assigning them rights are as follows:

n administrators Members of this group have unrestricted access to the client running Windows 7

n Backup Operators Members of this group are able to override file and folder access

restrictions for the purpose of backing up data

n Cryptographic Operators Members of this group are able to perform cryptographic

operations This policy is used only when Windows 7 is deployed in a special

configuration called common criteria mode In this mode administrators are able to

read and write all settings except those related to the cryptography of IPsec policy

n Distributed COM Users Members of this group are able to manipulate Distributed

COM objects on this computer

n event Log readers Members of this group can read data stored in the event logs

n Network Configuration Operators Members of this group can change Transmission

Control Protocol/Internet Protocol (TCP/IP) address settings

n performance Log Users These users can schedule the logging of performance

counters, enable trace providers, and collect event traces

n performance Monitor Users These users can access performance counter data locally

and remotely

n power Users This group is included for backward compatibility

n remote Desktop Users Members of this group are able to log on remotely through

remote desktop

n replicator This group is used to support file replication in domain environment

You can learn more about the default local groups by navigating to the following Microsoft

TechNet Web site: http://technet.microsoft.com/en-us/library/cc771990.aspx You should be

aware that some of the groups on this list are relevant only to domain environments.

quick Check

n How can you delete credentials that you stored when using Runas with the

/savecred option?

quick Check answer

n You can delete the credentials using Credential Manager.

Smart Cards

Smart cards store digital certificates that you can use for authentication Smart cards are more

secure than authenticating using user names and passwords This is because it is possible for

someone else to learn and use a person’s user name and password without that person being

aware of it, but it is very difficult for someone else to possess a smart card without the owner

of the smart card becoming aware of the fact that she no longer has it If a smart card is missing, an administrator can revoke the certificate stored on the smart card This makes the missing smart card useless

Windows 7 supports the PIV standard that was issued by the National Institute of

Standards and Technology (NIST) Support for this standard allows Windows 7 to obtain drivers for smart cards from Windows Update or a PIV-compliant mini-driver that is

included with Windows 7 The advantage of this is that you can use smart cards directly with Windows 7 without requiring specific vendor software

Smart cards allow you to implement multifactor authentication on clients running

Windows 7 Multifactor authentication requires a user to authenticate using two or more

separate methods The user might have to provide a user name/password and smart card,

or a user name/password and biometric ID, such as a fingerprint The most common form of multifactor authentication used with clients running Windows 7 in enterprise environments

is smart card and password authentication Biometric authentication is more likely to be used

on portable stand-alone clients running Windows 7 and cannot be integrated into Active Directory Domain Services (AD DS) without third-party products

Although Biometric authentication is unlikely to be tested on the 70-680 exam, you can learn more about support for Biometrics at the following Microsoft TechNet Web page:

http://technet.microsoft.com/en-us/library/dd367857.aspx.

Windows 7 has the following policies related to smart cards These policies are located

in the Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options node and are as follows:

n Interactive Logon: require Smart Card When this policy is enabled, users are able to log onto the computer only using a smart card When the policy is disabled, which is the default setting, users can log on using any method

n Interactive Logon: Smart Card removal Behavior This policy allows you to

determine how the computer reacts when a user removes his smart card The default setting is for no action to be taken if a smart card is removed The other options that are available are:

• Lock Workstation When you implement this setting, Windows 7 locks the

screen if the user removes the smart card The user can only unlock the screen by reinserting the smart card

• Force Logoff When you implement this setting, the user is forcibly logged off

• Disconnect If a remote Desktop Services Session This policy applies to what

is known as Terminal Services sessions hosted on Windows Server 2008 Terminal Services is renamed Remote Desktop Services in Windows Server 2008 R2 This policy forces a disconnection from the Remote Desktop Services session when the user removes his smart card

More Info SMart CarDS IN WINDOWS 7

To learn more about using smart cards with Windows 7, consult the following Microsoft

TechNet Web page: http://technet.microsoft.com/en-us/library/dd367851.aspx.

Account Policies

Password and account lockout policies, which can be found under the Computer

Configuration\Windows Settings\Security Settings node of Group Policy, allow you to configure

how passwords work on clients running Windows 7 You can use these policies to configure

settings such as the length of time a user can use the same password before needing to

change it, whether accounts are locked out after a number of invalid passwords are entered,

and whether passwords must meet a set of complexity requirements

You can configure the following password policies:

n enforce password history Use this policy to ensure that people do not use a small

set of passwords that they rotate through each time they are asked to update their

password When you configure the Enforce Password History, Windows 7 remembers

a certain number of prior passwords and does not allow users to set their new

password to one they have used previously When configuring this policy, you specify

how many passwords Windows remembers

n Maximum password age The maximum number of days that a person can keep the

same password Once this limit expires, users must change their password If a user

account has the Password Never Expires setting enabled (not recommended), it is not

subject to this policy

n Minimum password age Use this policy to require that a new password be kept for

a minimum number of days before the user is allowed to change it This stops users

from rapidly changing passwords so that they can go through their existing password

history and end up keeping the same password they had before they were asked to

change it the first time

n Minimum password Length Use this policy to ensure that passwords have

a minimum number of characters

n password Must Meet Complexity requirements Use this policy to require passwords

to include three of the following: uppercase letters, lowercase letters, numbers, and

symbols When you enforce this policy, passwords also cannot contain part of the

user’s first name, last name, or user name

n Store passwords Using reversible encryption Use this policy only if you are using

older applications that use older authentication technologies This policy makes

password storage less secure

You can configure the following account lockout policies:

n account Lockout Duration Use this policy to configure the length of time an account

is locked out before a user can attempt to log in again

n account Lockout threshold Use this policy to configure the number of times a user can enter an incorrect password before Windows locks out the account

n reset account Lockout Counter after Use this policy to specify the period in which Windows records invalid logon attempts For example, if you set this period to 30 minutes and the Account Lockout Threshold policy is set to 3, three invalid logon attempts in

30 minutes triggers a lockout whereas three invalid logon attempts in 31 minutes will not

A valid logon automatically resets the account lockout counter

Resolving Authentication Issues

The most common authentication issue that users face is that they have forgotten their

password There are two methods that you can use to deal with this problem: password

reset disks and resetting user account passwords Password reset disks, which can include universal serial bus (USB) storage devices, have the advantage that they allow a user to recover

a forgotten password without losing encrypted data The downside of password reset disks is that you must create one prior to the password being lost Another disadvantage is that they can

be used by anyone to recover that specific account’s password, so they must be kept in a secure location because anyone who has access to the disk can gain access to the user’s computer You can create a password reset disk, which can store password reset data on a floppy disk or a USB flash disk, by using the Create A Password Reset Disk item in the User Accounts Control Panel Clicking the Create A Password Reset Disk item starts the Forgotten Password Wizard When you use the wizard, you check which removable storage device you will store the data on and then enter the current user account password, as shown in Figure 9-14 You can activate the Password Reset Wizard once an incorrect password is entered on the Windows 7 logon screen When using this wizard, the user specifies the password reset disk’s location (either floppy disk or USB device) and then enters the new password The user still has access to all her encrypted data

If a user has forgotten her password and there is no password reset disk available, it will be

necessary to change the password This can be done through the Users node of the computer

management console or by using the Manage Accounts option within the User Accounts

control panel Only members of the local Administrators group can change another user’s

password When you change a user’s password, the user loses all access to EFS-encrypted

files, personal certificates, and stored passwords that are stored with the Windows Vault in

Credential Manager, as displayed in Figure 9-15 If the user has backed up these passwords

and certificates, it is possible to recover some items by restoring the Windows Vault If the

user has backed up her EFS key, she can access her encrypted files by restoring that key

You will learn about backing up and restoring EFS keys later in this lesson It is also possible

for an administrator to recover EFS-encrypted files if there is an existing EFS recovery agent

configured for the computer You learned about creating EFS recovery agents in Chapter 8,

“BranchCache and Resource Sharing ”

FIgUre 9-15 Change Password warning

If you have configured account lockout policies, a user may have his account locked out if

he enters an incorrect password the number of times specified in the policy You can unlock

the account by editing the account properties using the Computer Management Console and

removing the check next to the Account Is Locked Out setting, as shown in Figure 9-16 Only

members of the local Administrators group can unlock accounts Unlocking an account does

not reset the account password and has no impact on stored credentials or EFS certificates

A user that has an unlocked account still needs to remember his password before he is able to

log on to the computer running Windows 7

FIgUre 9-16 Account lockout

Managing Certificates

Although you cannot use Credential Manager to back up EFS certificates, Windows 7 includes three other tools that you can use to perform this task These are the Certificates Console (Certmgr msc), the Manage File Encryption Certificates tool, and the Cipher exe command-line tool Each of these tools can be used to back up or export an existing EFS certificate to

a password-protected PFX file This PFX file can then be imported on other computers, or back to the original computer if necessary, either by using these tools, or double-clicking the PFX file using Windows Explorer

Most users will use the Manage Your File Encryption Certificates tool, shown in Figure 9-17,

to back up their EFS certificates because it is easier to use than other tools This tool comprises

a wizard that can be used either to back up your certificates or to configure EFS to use a smart

card The tool is accessed by typing Manage File encryption Certificates into the Search

Programs And Files text box Using the wizard, you select the certificate that you want to back up, the location where the backup will be stored, and the password used to protect the backup

The Certificates console, shown in Figure 9-18, can also be used to back up EFS certificates

This console can be opened by typing certmgr.msc into the Search Programs And Files

text box Certificates can be exported to password-protected PFX files by right-clicking the certificate that you want to export and then clicking Export This console is less likely to

be used by normal users because it is less intuitive than the Manage Your File Encryption Certificates tool You have to remember that your EFS certificate is stored under the

Personal\Certificates node, something that might not be obvious to a non-technical user