Well-Known Security Principals
The term well-known security principal refers to fixed accounts that are somewhat like users or groups. However, you cannot delete or rename them. Actually, you don't even see them in the list of users and groups (except in the dialog boxes where you give permissions).
A well-known security principal may include a number of users, but you cannot designate who these "members" are. For example, whether a user is a "member" of Interactive depends on the circumstances—he is a "member" if he is sitting at the computer where the resource being accessed resides.
The reason for well-known security principals to exist is that they allow administrators to assign permissions to these special identities, so that appropriate users can use those permissions. You can also think of well-known security principals as "dynamic groups," because their "member" lists are dynamically determined. Do not confuse them, however, with query-based groups, which were introduced in Windows Server 2003. The number of these "dynamic groups" was increased in Windows Server 2003, compared to Windows 2000 (which in turn was increased, compared to Windows NT). This indicates that future versions of Windows may introduce even more of them, such as "Those-who-authenticated-using-a-smart-card."
List of well known Security Principal.
anonymous Logon; Authenticated Users; Batch; Creator Owner; Creator Group; Dialup; Enterprise Domain Controllers; Everyone; Interactive; Network; Proxy; Restricted; Self (or Principal Self); Service; System (or LocalSystem); Terminal Server User; This Organization; Other Organization; Local Service; Network Service; NTLM Authentication; SChannel Authentication; Digest Authentication; Remote Interactive Logon.
Refer:
http://support.microsoft.com/kb/243330
Sunday, 9 September 2007
Subscribe to:
Post Comments (Atom)
0 comments:
Post a Comment