Using Windows NT Workstation 4.0

- 3 -
Windows NT and Your Office

In this chapter:

Learn what you can--and can't--do with your PC
How your administrator defines your role in the company
Connecting to the company network
Using (and losing) your password

You have rights--plenty of them. But before you can use your computer or connect to your company's network, you'll have to identify yourself to Windows NT ...

When you own your own business, you get to make all the decisions on your own. You decide when to open the doors and when to shut down. You choose who has a key to the front door and who has to sign in with the security guard. To keep phone costs down, you might set things up so only a few key employees have the right to make overseas phone calls--and only if they punch in a secret access code first.

If you're an employee, you're on the other end of all those decisions. It may be inconvenient to use an electronic card key just to enter the front door, but you tolerate the nuisance in exchange for the security of knowing that total strangers can't wander through your company's hallways. Likewise, when your company uses Windows NT, you'll face a similar set of restrictions--a long, usually logical list of do's and don'ts designed to safeguard the computer on your desktop, other computers on your company's network, the programs you use, and the data files you and your coworkers create.

It all starts with you

Have you used a personal computer before? If you're using Windows NT for the first time, be prepared to adjust your thinking--and your ways of working. Your old computer probably used a different operating system, such as MS-DOS or Windows 3.1. With these and other operating systems, you're free to do just about anything you want on your own computer, even installing your own application software and adding new hardware if you wish.

Now that you're using Windows NT, things are very different. This operating system is designed with the same sort of protective services you'd find at a security-conscious office building. Before you can get past the guard's desk, you have to sign in, and you'd better have proof that you are who you say you are. Even after you've gotten into Windows NT, you'll discover that some doors--well, OK, windows--are locked, and you don't have the key.

An administrator manages your PC

In my office, there are locks everywhere you turn. I have a key to the front door and another one that unlocks my office door. A few people who can be trusted not to steal all the pens have a key to the office supplies closet. Sensitive personnel files are kept in locked file cabinets, and only the president and the human resources director have keys. Of course, the cleaning crew has a master key that gets them in practically anywhere.

That's roughly how Windows NT works as well. The person who installed the software on your computer is called the system administrator, and that person has the equivalent of a master key that opens every lock on your PC. The administrator can read your data files, install and remove programs, even erase your entire hard disk! Most important of all, though, the system administrator determines what you can and can't do with your computer and the rest of the computers in your company.

The system administrator assigns user names and passwords, and decides who can use a given computer or printer. Typically the administrator will create a set of folders where you can store files you create and edit; other users won't be allowed to snoop in those folders. He or she also creates groups of users with common permissions; by adding your user name to the Accounting group, for example, the administrator could tell Windows it's OK for you to use the laser printer outside Bob's office and to look at files in the Budget folder.

If you try to do something with your PC that you don't have permission to do, you'll see an error message like the one in Figure 3.1.

Fig. 3.1

Certain tasks are reserved only for administrators. Windows won't let other users install a new hardware driver, for example.

TIP: Don't be surprised if your system has more than one administrator. In most companies, several people have the right to act as administrator on a given PC; that way, someone's always available to help with a problem, even if the regular system administrator is out sick or on vacation.

Know your (user) rights

The administrator uses a special program called the User Manager to track which users and groups have which permissions (see Fig. 3.2). Based on your company's policies, the system administrator has decided which of the following things you can do:

Log on locally. If this is your computer, you certainly have this right. Coworkers and assistants may also have the right to log onto your machine, with a different set of permissions.
Access this computer from the network. You'll have this right if you're expected to "roam" from place to place and still be able to connect with the data stored here. Other users may also have this right if you expect to share files with them.
Back up and restore files and directories. This is a special sort of permission intended just for people who operate backup devices like tape drives. They can't read your files, but they can make copies of your data to protect it in case of disaster.
Shut down the system. Most users have this right automatically. If your PC contains files that other people need to access, or if a shared printer is connected to your PC, the administrator may set things up so the Shut Down menu choice doesn't work.
Change the system time. If you share lots of files with coworkers, it's crucial that the time stamp be correct on each one. E-mail programs are also picky about this setting. The administrator may choose to set each PC's clock from a central location and not allow users to adjust it.
Perform special system tasks, such as loading device drivers or managing a security log. Typically these tasks are reserved for administrators only.
Take ownership of files or other objects. This setting lets you bypass the lock that a user has put on a file or folder. You have to be very well trusted to earn this right.

Fig. 3.2

Administrators and Power Users can organize users into groups and give them specific rights with the help of the User Manager.

Find your place in the big picture

As I said earlier, it's a lot of work to assign one right at a time to each user. It's more convenient to create groups of users, each with its own "package" of user rights, and then add users to that group, where they will automatically have the same rights as all the others in the group.

Windows NT includes the following predefined groups, and chances are you already belong to one of them:

The Administrators group includes everyone who has the right to log on and act as an administrator. Some administrators keep two accounts--one in this group, which they can use when they need to do system maintenance, and another account, for everyday use, that has more restricted user rights.
Everyone is the least exclusive group of all. Typically users in this group get the right to log on to a specific machine and shut it down, and that's all.
Users have restricted rights, not because they're not trusted, but because administrators want to keep them from accidentally deleting important files or stumbling into areas where they don't belong.
Power Users are assumed to be more experienced (like you, after you've read this book!) and are allowed to share files and folders with other users, and to create new user accounts on their own computers.
Guests, as the name implies, are allowed to log on to a machine and use it temporarily. A guest account might be created to allow visitors to log on and use a few application programs and a shared printer, storing their files in a special folder not shared by anyone else.
Backup Operators are allowed to get around file and folder security, but only for the purpose of making backup copies of important data files.

Halt! Who goes there?

In gangster movies from the 1930s, heroes and bad guys alike had to use a special knock and say the secret word before they could get past the front door. You'll have to go through the same process--although with considerably less melodrama--to start Windows NT each day. After your system has gone through its startup routine, you'll see the dialog box shown in Figure 3.3.

Fig. 3.3

Before you can get started with Windows NT, you have to press the Ctrl, Alt, and Del keys, all at the same time.

Instead of a secret knock, you have to press a particular key combination: Ctrl-Alt-Del. When you do, you'll see a logon screen like the one in Figure 3.4. Type your password and press Enter.

Fig. 3.4

Windows needs your user name and password to verify that you really are who you say you are.

The basic concept of logging on is simple: Windows acts like a no-nonsense security guard. You have to show your identification, and then Windows has to check the list of names to make sure it's OK for you to come in. The password, which only you should know, is as good as a photo ID. When the system administrator first created an account for you, he or she added your name to the list of authorized users and gave you a password.

TIP: Why did Microsoft choose Ctrl-Alt-Del to start up Windows NT? For security's sake, naturally. With most other PC operating systems, that combination of keys restarts the computer. If the Windows NT logon box appears instead, you can be certain that Windows NT is really running.

Connecting to the Network

Once you've logged on, the Windows NT security system lets you see the files on your own computer. It also allows you to do things with other computers and printers on the network. Exactly what you can do is determined by the permissions you've been granted. We'll talk more about networking in Chapter 20.

Q&A: Help--I've forgotten my password! How do I get to my files?

Ask your administrator. He or she can't tell you what your password is, but the administrator can do the next best thing, by deleting the old one and giving you a brand-new password.

Changing your password

Every so often, just on general principle, you should change your password. And if you ever even suspect that someone has learned your password, change it right away. It's not difficult: Just press Ctrl-Alt-Del and click the button labeled Change Password. You'll see a dialog box like the one in Figure 3.5.

Open Sesame...

You use passwords all the time, although you might not think of them that way. The PIN number that coaxes cash out of your ATM? That's a password. The numbers you have to push before you can listen to your voice mail? Password. Your Social Security number and mother's maiden name? If the bank makes you recite both before they'll talk about your balance, that's a password. Although as we'll see, it's not a very good one.

The reason you use a password in the first place is to protect your privacy. The more people who know that password, the less secure you can expect your data to be. If you write your password on a Post-It note and stick it on your monitor, you're practically rolling out the red carpet for meddlers and thieves.

Here are some time-tested rules for making sure that your passwords remain your little secret.

Make the password long enough to resist random guessing by a stranger--at least 8 characters.
Avoid the obvious--don't use your birthday or your Social Security number or the names of your kids as a password.
Mix numbers, letters, and symbols; nonsensical combinations are much harder to guess.
If you must use a real word, use something that you won't forget and no one else could possibly guess, like the name of the sled you had when you were a child.
Change your password regularly--at least as often as you change the oil in your car. Your system administrator may require that you change passwords every 6 weeks or so.
Don't forget: A good lock is sometimes more effective than any password.

Fig. 3.5

To change your password, you first have to enter your old password. Then type the new one, and type it again to make sure you didn't make a mistake the first time.

What do you do if you can't change your password? Your system administrator may have placed additional restrictions on your account. For example, she may have told Windows that your password has to be at least 10 characters, or that you can't reuse any of the last four passwords you've used. If you have trouble, ask your system administrator whether any of these restrictions apply to you.