print barcode labels in c# Figure 8-5 A Permissions dialog box for a registry key in Visual Basic .NET

Printing ECC200 in Visual Basic .NET Figure 8-5 A Permissions dialog box for a registry key

By default, members of the Administrators group have the Full Control permission for all the keys in the registry. The Everyone group has the Read permission only for the HKEY_LOCAL_MACHINE and HKEY_USERS keys, and the Server Operators group has permissions that enable them to read, add, and modify certain registry keys, without giving them full control. In most cases, there is no need to modify registry permissions manually, but if you want to create a class of administrative users that has limited access, you might want to modify the permissions of the Server Operators group.

Windows Server 2003 has yet another system of permissions, which you can use to specify who can access and manage objects in the Active Directory database. On a large network, working with Active Directory objects is a common administrative task.

8-25

Administrators frequently have to create or delete user objects or modify the properties of existing objects. To delegate these tasks to other people, you might want to modify the default permissions for all or part of the Active Directory database. When you create a new Active Directory domain by assigning a computer running Windows Server 2003 the role of domain controller, the system creates default permis sions for the following groups:

Enterprise Admins Enterprise Admins is the only group that receives the Full Control permission over the entire domain. Domain Admins and Administrators The Domain Admins and Administrators groups both get a selection of permissions that enable them to perform most Active Directory object maintenance tasks. They can create objects and modify their properties, for example, but they cannot delete objects. Authenticated Users The Authenticated Users group receives the Read permis sion for the entire domain, plus a small selection of very specific Modify permis sions. For example, members of this group receive the Unexpire Password permission, which enables them to change their own passwords after an expira tion period specified by an administrative policy.

There are two ways to modify the default permissions that the Windows operating sys tem assigns to Active Directory objects. You can use the Delegation Of Control Wizard in the Active Directory maintenance snap-ins for the Microsoft Management Console (MMC), or you can modify the permissions directly. The Delegation Of Control Wizard simplifies the process of delegating responsibility for a part of the Active Directory database to a user or group (see Figure 8-6).

Figure 8-6

8-26

8

The drawback of using the Delegation Of Control Wizard is that you cannot view the permissions you have set once you have assigned them. To do this, you must work with the permissions directly. By default, Windows directory service tools such as Active Directory Users And Computers do not provide direct access to the permissions. To modify this default, you select the Advanced Features option from the console s View menu. Once you do this, the Properties dialog box for each Active Directory object displays a standard Security tab, as shown in Figure 8-7.

Group policies are among the most powerful security features included with Windows Server 2003. You can create Group Policy Objects (GPOs) that do everything from dis tributing new software to configuring system security settings to remapping directories. You then associate the Group Policy Object with an Active Directory container object, such as a domain, a site, or an organizational unit, and the Windows operating system applies the policy to all the objects in that container. One of the security modifications that Microsoft has made in Windows Server 2003 is to enable some of the most commonly used policies by default. These are the account policies, which you can find in the Computer Configuration\Windows Settings\Secu rity Settings heading in the Group Policy Object Editor console (see Figure 8-8).