Managing Users, Workstations, and Shared Resources

Vocabulary practice cards covering user accounts, local security policies, workgroups, shared resource configurations, NTFS/Share permissions, and Active Directory domain fundamentals.

Security Group

A collection of user accounts that can be assigned permissions and rights in the same manner as a single user object, enabling efficient administrative assignment by grouping users.

Administrators Group

A built-in local group whose members can perform all management tasks and have very high access across all system files and objects. The user created during Windows installation is automatically added to this group.

Users Group

The standard built-in local group to which newly created users are typically added. Members can perform common tasks such as shutting down the system, running applications, changing the time zone, and installing a local printer if a suitable driver is pre-installed.

Guests Group

A built-in local group with limited rights that allows browsing the network and Internet and shutting down the computer, but prevents saving changes to the desktop environment. It is disabled by default.

Power Users Group

A deprecated legacy group provided for backward compatibility whose rights can potentially be abused to obtain full administrative or system privileges.

Everyone Group

A built-in system group whose dynamic membership includes all users accessing the computer, including unauthenticated users connected as guests.

Authenticated Users Group

A built-in system group consisting of all users accessing the computer who possess a valid user account.

Creator Owner Group

A built-in system group containing the account of the person who created a resource, though administrative users can take ownership when necessary.

Interactive Group

A built-in system group containing the user account of the individual who is currently logged on and working locally at the computer.

Network Group

A built-in system group that dynamically includes user accounts currently connected to the computer over a network connection.

LocalSystem Account

A non-interactive operating system account (NT_AUTHORITY) that possesses privileges equal to or greater than the default Administrator account and operates unrestricted access to system configuration and the file system.

LocalService Account

A non-interactive operating system service account with limited privileges that cannot make system-wide modifications and connects to the network anonymously.

NetworkService Account

A non-interactive operating system account that shares the limited local privileges of LocalService but authenticates to the network using the computer's machine account credentials.

Security ID (SID)

A unique internal identifier assigned by Windows to each user and group account. If an account is deleted and recreated with the identical username, it receives a new, distinct SID and loses prior resource access.

Local Security Policy (secpol.msc)

A Microsoft Management Console snap-in located in Administrative Tools used on standalone workstations to configure fine-grained settings such as password complexity, password history, and account lockouts.

Local Group Policy (gpedit.msc)

A management snap-in that provides a dialog-based interface for configuring computer and user settings across the registry without directly editing keys through regedit.

Single Sign-On (SSO)

An authentication model allowing a user to authenticate once to access multiple authorized resources and services without repeated logins, such as through Kerberos in an Active Directory domain.

Credential Manager

A Control Panel utility that stores and caches saved credentials and log-on passwords for websites, applications, and network shares.

Workgroup

A peer-to-peer Windows network model where every computer can act as both client and server, user accounts are maintained locally on each PC, and administration is decentralized.

Homegroup

A networking feature introduced in Windows 7 and Windows 8 that used a single shared password to simplify folder and printer sharing on home networks; deprecated and removed in Windows 10 version 1803.

Public Network Profile

A network location setting in Windows that disables file and printer sharing as well as network discovery to enhance security on untrusted connections.

Private Network Profile

A network profile tailored for home or work environments that permits customized file sharing, printer sharing, and network discovery.

Network Discovery

A setting in Advanced Sharing Settings that enables a computer to locate other devices on the network and make itself visible to them.

Public Folder

A pre-defined Windows directory available to all local users and network clients (when enabled) designed for straightforward, centralized local file sharing.

Share Permissions

Permissions configured at the root of a shared folder that dictate access levels across the network, categorized into Read, Change, and Full Control.

Full Control (Share Permission)

The highest level of share permission that allows users to view, create, edit, and delete files and subdirectories, as well as change permissions for other users and groups.

Change (Share Permission)

A share permission level that allows reading, creating, modifying, and deleting files and folders, but restricts modifying permissions for other users.

Read (Share Permission)

A basic share permission level allowing users to connect, navigate directories, open files, and execute programs, but strictly barring file creation, editing, or deletion.

Administrative Shares

Hidden default network shares created automatically by Windows for administrative purposes, marked with a trailing dollar sign ($), such as C$, ADMIN$, and PRINT$.

Universal Naming Convention (UNC)

A standard format for identifying shared network folders and paths using the syntax \ComputerName\Path.

Mapped Network Drive

A shared network folder assigned a local drive letter on a client machine so it appears alongside local physical drives under File Explorer.

Sync Center

A Windows Control Panel applet used to manage offline files, monitor synchronization partnerships, and resolve file version conflicts between local caches and network shares.

net use

A command-line tool used to connect to, map, and disconnect from shared network resources, drives, and printers.

net view

A command-line utility used to display a list of computers on the network or enumerate the shared resources offered by a specified host.

Access Control List (ACL)

A security list maintained in the NTFS Master File Table (MFT) for each file and directory, defining the specific users, groups, and permissions associated with that object.

Effective Permissions

The net combined permissions a user holds over a resource after evaluating direct permissions, group memberships, inheritance, and the overarching rule that Deny overrides Allow.

Permission Propagation and Inheritance

The mechanism in NTFS where permissions assigned to a parent folder automatically pass down to newly created subfolders and files.

Security Account Manager (SAM)

The local database stored under the HKEY_LOCAL_MACHINE registry hive on standalone workstations that stores local user account and security information.

Active Directory (AD)

The directory service database hosted on Windows Server domain controllers that centralizes identity management, computers, groups, and network security policies across a domain.

Domain Controller (DC)

A Windows Server running Active Directory Domain Services responsible for storing directory information and authenticating users and computers on the domain.

Member Server

A server that belongs to an Active Directory domain providing services (such as file, print, SQL Server, or Exchange) without hosting a copy of the Active Directory database or processing logon authentication.

Organizational Unit (OU)

A container object within an Active Directory domain used to organize users, computers, and groups into manageable administrative divisions and apply Group Policy Objects.

Group Policy Object (GPO)

A virtual collection of policy settings linked to Active Directory containers (such as domains or OUs) used to enforce centralized configuration baselines across network computers and users.

Resultant Set of Policies (RSoP)

The cumulative compilation of policy rules that take effect on a specific user or computer after calculating GPO links, order of precedence, and inheritance filters.

gpupdate

A command-line utility that immediately applies updated local or group security policy settings to a client computer without waiting for the default $90\text{ minutes}$ refresh cycle.

gpresult

A command-line utility used to view and audit the Resultant Set of Policies (RSoP) applied to a specific user account and computer.

Logon Script

A script assigned via Group Policy or user properties that executes automatically during logon to configure drive mappings, environmental variables, or network printer connections.

Home Folder

A private storage location hosted on a shared network file server designated for individual user file storage and administrative backups.

Folder Redirection

A Windows administrative technology that redirects the path of local user profile directories (such as Documents or Desktop) to a centralized network share.

Roaming Profiles

A configuration where a user's entire profile data is saved to a network location, enabling consistent user environment settings regardless of which domain computer they sign into.