IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Hardware & Software Remarks
____________________________________________________________________ .........................................
S 4.51 User profiles to restrict the usage possibilities
of Windows NT
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: Administrators
User profiles are used to store user specific settings in the system
environment. This includes the contents of program groups, network
connections, used printers, and the colour scheme of the screen. The
capabilities of users for working with Windows NT can be restricted in
various respects by means of user profiles. Profiles are administrated using
User Profile Editor (UPEDIT.EXE under Windows NT 3.51 or
POLEDIT.EXE under Windows NT 4.0).
User profiles can be created for various usage purposes:
- in the case of single-user systems, to recover the settings originally
specified following a repeated log-on,
- in the case of multi-user systems, to specify their own settings for each
user,
- so that, in the case of server-stored user profiles, each user receives the
same interface from each NT workstation,
- to specify uniform user environments centrally (both for stand-alone and
networked systems),
- to establish a restricted user environment, for example, to prevent users
from making changes to desktop settings or restrict access to the control
panel.
A distinction must be drawn in principle between local and server-stored user
profiles. Local user profiles are only stored on the local IT system, whereas
server-stored user profiles are administrated centrally on the NT server.
If the server breaks down when using server-stored user profiles, recourse is
had to the local copy.
Alongside this, a distinction must be drawn between personal and mandatory
user profiles. Personal user profiles can be changed by the user at will,
mandatory ones are specified by the administrator.
Mandatory profiles are maintained from one session to the next, changes made
during a session are lost when logging-off. These profiles are stored in the
directory which is specified in the profile entry of the relevant account, and
under version 3.51 of Windows NT they carry the file name extension .MAN.
As from version 4.0, a profile is identified as a mandatory profile by renaming
the file NTUSER.DAT in NTUSER.MAN.
Personal profiles which are stored on a server can be used to provide users
with the same environment, irrespective of the workstation from which they
are logging on. Personal profiles are stored in the directory which is specified
in the profile entry of the relevant account, and under version 3.51 they have
the file name extension .USR.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000