Windows NT Security Features

Windows NT has features designed to make it easy to give permissions to some groups of users while denying those permissions to others. These features are discussed in detail in the documentation for Windows NT Workstation or Windows NT Server, and elsewhere in the Windows NT Resource Kit. You'll need to become familiar with this information in order to plan and implement the security configuration of your choice.

The following table lists documents that are referred to in this discussion of computer security.

User Accounts

The key to Windows NT security is the user accounts. You can create as many accounts as are needed, and you can include any user account in as many groups of accounts as are appropriate. You can then permit or limit access to any computer resource to individual accounts or to groups. User accounts are discussed in detail in the "User Manager" chapter in the Windows NT Workstation or Windows NT Server System Guide.

Passwords

In the "User Manager" chapter in the Windows NT Workstation or Windows NT Server System Guide you'll also find a description of the password enforcement options, such as minimum password length, minimum and maximum password age, password "uniqueness" (how often a password can be reused), and controls over whether a user can — or must — change his or her password.

File and Directory Protection

A range of file protections can be set on a per-file or per-directory basis. The protections can be on a per-user or per-group basis. This feature is described in the "Securing Directories and Files" section of the "File Manager" chapter of the Windows NT Workstation or Windows NT Server System Guide and in Chapter 2, "Windows NT Security Model," in the Windows NT Resource Guide. Note particularly the section on "Access Control Inheritance" in Chapter 2 of the Windows NT Resource Guide. Specific files to protect are discussed later in this manual, in the section "Protecting Files and Directories" under "High-Level Security."

Registry Protection

Since the Registry is the repository of all system configuration information, it is important to protect it from unauthorized changes. At the same time, individuals and programs that need to access or alter information in the Registry must be allowed to do so. Part IV, "Windows NT Registry," of the Windows NT Resource Guide discusses the Registry and the Registry Editor, including information on protecting keys in the Registry. Specific keys to protect are discussed later in this manual, in the "Protecting the Registry" sections under "Standard Security" and "High-Level Security."

Printer Protection

You can prevent specific users from printing to a system printer for all or part of the day. This feature is described in the "Print Manager" chapter of the Windows NT Workstation or Windows NT Server System Guide.

Auditing

Auditing is built into Windows NT. This allows you to track which user account was used to attempt what kind of access to files or other objects. Auditing also can be used to track logon attempts, system shutdowns or restarts, and similar events. Auditing is described in the "Event Viewer" chapter of the Windows NT Workstation or Windows NT Server System Guide and in Chapter 2, "Windows NT Security Model," in the Windows NT Resource Guide.