Appendix D - User and Group Accounts

Windows 2000 Built-In Users and Groups	Description	Stand Alone Professional	Stand Alone Servers	Domain Controller	Default Members	Applicability to Security Target Requirements and/or Rationale for Changes
Local User Accounts	Default Local user accounts.
Administrator	Built-in account for administering the computer/ domain.					Use of this account by more than one authorized administrator violates FAU_GEN.2, User Identity Association which states that each auditable event must be associated with the identity of the user that caused the event. Requirement: Assign roles to authorized administrators by placing their user accounts in administrative groups appropriate to their level of responsibility. This ensures that all administrative actions can be tracked in audit logs to specific user accounts. Rename the Administrator account and secure the password for emergency use only.
Guest	Built-in account for guest access to the computer/ domain.					Misuse of this account can violate FAU_GEN.2, User Identity Association, FIA_UAU.2, Authentication, and FIA_UID.2, User Identification Before Any Action. This account is disabled on all systems by default. Requirement: This account must remain disabled.
TsInternet User	User account used by Terminal Services. It is used by the Terminal Services Internet Connector License. When Internet Connector Licensing is enabled, a Windows 2000-based server accepts 200 anonymous-only connections. Terminal Services clients are not prompted with a logon dialog box; they are logged on automatically with the TsInternet User account.					Use of this account by more than one user violates FAU_GEN.2, User Identity Association. Requirement: Terminal Services is not an objective of the TOE and accounts that support anonymous access are not to be allowed. Therefore, disable this account.
krbtgt	Key distribution service center account. Windows 2000 Kerberos authentication is achieved by the use of tickets enciphered with a symmetric key derived from the password of the server or service to which access is requested. To request such a session ticket, a special ticket, called the Ticket Granting Ticket (TGT) must be presented to the Kerberos service itself. The TGT is enciphered with a key derived from the password of the krbtgt account, which is known only by the Kerberos service.					Use of this account by more than one user violates FAU_GEN.2, User Identity Association. This account is disabled on Domain Controllers by default. Requirement: Unlike other user accounts, the krbtgt account cannot be used to log on to the domain and in fact, cannot be enabled
Global Groups	When a domain is created, Windows 2000 creates the following built-in global groups in the Active Directory store to group common types of user accounts for use throughout the domain.					Global groups provide the ability to assign users to authorized administrator and authorized user roles with unique domain-level access restrictions based on the global group to which the user is assigned. Global groups support the FMT_SMR.1, Security Roles TOE Security Functional Requirement.
Cert Publishers	Enterprise certification and renewal agents. Includes all computers that are running an enterprise certificate authority. Cert Publishers are authorized to publish certificates for User objects in Active Directory.				None	Windows 2000 Cert Server is not in the Evaluated Configuration
DnsUpdate Proxy	DNS clients who are permitted to perform dynamic updates on behalf of some other clients (such as DHCP servers).				None	The TOE will support FQDN and does not require membership in this group. Requirement: Do not add accounts to this group
Domain Admins	This group is only available on Windows 2000 servers acting as Domain Controllers. Its members are allowed administrative privileges for the entire domain. By default, this group has the local Administrator account on the Domain Controller as its member.				Administrator	Supports assignment of administrative role with control within a specific domain. Requirement: Do not add non-administrative accounts (users) to this group.*
Domain Computers	All servers and workstations joined to the domain, excluding domain controllers.				None	Supports assignment of user role supporting access to domain-computer- specific resources.
Domain Controllers	Group account for all Domain Controllers in the domain.				DC_Name	Supports assignment of user role supporting access to domain-controllers- specific resources
Domain Guests	This group is only available on Windows 2000 servers acting as Domain Controllers. Members of this group are only allowed to access the system from across the network and have very limited privileges by default and initially only contains the Guest user account for the domain.				Guest	Guest/anonymous accounts can violate FAU_GEN.2, User Identity Association, FIA_UAU.2, Authentication, and FIA_UID.2, User Identification Before Any Action. Requirement: Do not use this group. Remove all accounts including Guest from this group.
Domain Users	This group is only available on Windows 2000 servers acting as Domain Controllers. In a domain environment, the Administrator account and all new user accounts are automatically included as members of this group. This group is also a member of the Users local group for the domain and for every Windows computer in the domain.				Administrator Guest Krbtgt TsInternet User (all new users are added by default)	Supports assignment of user role supporting access to domain resources. Guest/anonymous accounts can violate FAU_GEN.2, User Identity Association, FIA_UAU.2, Authentication, and FIA_UID.2, User Identification Before Any Action. Requirement: Remove the Guest, and TsInternet User accounts.
Enterprise Admins	Provides administrative control over the entire network. By default, the Domain Controller's Administrator account is a member. The group is authorized to make forest-wide changes in Active Directory, such as adding child domains.				Administrator (Domain Controller)	Supports assignment of administrative role with control over the entire network.
Group Policy Creator Owner	Members in this group can modify group policy for the domain. The group that is authorized to create new Group Policy objects in Active Directory.				Administrator	Supports assignment of administrative role designated to maintain domain level group policies. Requirement: Do not add non-administrative accounts to this group.*
Schema Admins	Designated administrators of the Active Directory schema. The group is authorized to make schema changes in Active Directory.				Administrator	Supports assignment of administrative role designated to administer the Active Directory Schema. Requirement: Do not add non-administrative accounts to this group.*
Domain Local Groups	Domain local groups provide users with privileges and permissions to perform tasks specifically on the domain controller and in the Active Directory store.					Domain local groups provide the ability to assign users to authorized administrator and authorized user roles with unique Domain Controller access restrictions based on the domain local group to which the user is assigned. Domain local groups support the FMT_SMR.1, Security Roles TOE Security Functional Requirement.
Account Operators	This group is only available on Windows 2000 servers acting Domain Controllers. It allows its members to administer user and group accounts for systems and domains. By default, Account Operators have permission to create, modify, and delete accounts for users, groups, and computers in all containers and organizational units (OUs) of Active Directory except the Builtin container and the Domain Controllers OU. Account Operators do not have permission to modify the Administrators and Domain Admins groups, nor do they have permission to modify the accounts for members of those groups.				None	Supports assignment of administrative role designated to manage user accounts within a domain. Requirement: Do not add non-administrative accounts to this group.*
Administrators	Members can perform all administrative tasks on all domain controllers and the domain itself.				Administrator Domain Admins Enterprise Admins	Supports assignment of administrative role with full administrative access rights to all domain controllers and resources within a domain. Requirement: Do not add non-administrative accounts to this group.*
Backup Operators	Members can back up and restore files on all domain controllers by using Windows Backup, regardless of the permissions that protect those files. Backup Operators also can log on to the computer and shut it down.				None	Misuse of this account can violate FDP_ACF.1(a), Discretionary Access Control. A member of the Backup Operators group can extract files and directories for which the user would normally not have access. Membership in this group permits users to open any file for backup purposes; however, once the file has been opened for read access it can be redirected by the Backup Operator to any location. By default, users are allowed to backup and restore files for which they have the appropriate file and directory permissions without requiring membership in the Backup Operators group. The Administrator account already has full backup rights. Requirement: Do not add non-administrative accounts to this group.*
DnsAdmins	DNS administration group. This group has Full Control over a DNS Server and its zones.				None	Supports assignment of administrative role responsible for administering DNS. Requirement: Do not add non-administrative accounts to this group.*
Guests	The Guest group offers limited access to resources on the system. Members cannot make permanent changes to their desktop environment. Some services automatically add users to this group when they are installed. For example, IIS adds anonymous user accounts to the Guests built-in group.				Guest (local) Domain Guests TsInternet User	Guest/anonymous accounts can violate FAU_GEN.2, User Identity Association, FIA_UAU.2, Authentication, and FIA_UID.2, User Identification Before Any Action. Requirement: Do not use this group. Remove all accounts including Guest from this group.
Pre-Windows 2000 Compatible Access	A backward compatibility group that allows read access on all users and groups in the domain.				None	Requirement: Backward compatibility with pre-Windows 2000 systems is not an objective of the TOE. Therefore, do not add users to this group.
Print Operators	A built-in group that exists only on domain controllers. Members can set up and manage network printers on domain controllers. Members of this group are given the rights to create, change, and delete printer shares within the domain. Members can also log on to systems locally and shut them down.				None	Supports assignment of administrative role responsible for managing print services within a domain. Recommendation: This is an administrative function, therefore only add authorized administrators to this group.
Replicator	Supports file replication on Domain Controllers. It is used by the File Replication service on domain controllers. Members can configure file replication services. The directory replicator service is used to automatically copy files, such as user logon scripts, between Windows 2000-based computers.				None	Can be used in support of requirements identified in para 6.1.5.3, TFS Data Replication Consistency. Supports assignment of administrative role responsible for administering directory replication services within a domain. Requirement: Do not add non-administrative accounts to this group.*
RAS and IAS Servers	Servers in this group can access remote access properties of users.				None
Server Operators	This group is only available on Windows 2000 Servers acting as Domain Controllers. Members of this group can perform server management tasks such as creating, changing, and deleting shared printers, shared directories, and files. They can also back up and restore files, lock the server console and shutdown the system. They cannot modify system policies or start and stop services.					Supports assignment of administrative role responsible for server maintenance. Requirement: Do not add non-administrative accounts to this group.*
Users	This group provides the user with the necessary rights to operate the computer as an end user, such as running applications and managing files. By default, Windows 2000 adds all new local user accounts to the Users group.				Authenticated Users Domain Users INTERACTIVE (all new local users are added by default)	Supports assignment of user role supporting access to resources on the domain controller. Requirement: Do not accounts with potential for unauthenticated access (such as Guest) to this group.
Local Groups	All stand-alone Windows 2000 Servers, member servers, and Professional workstations have built-in local groups. These built-in local groups provide members with the capability to perform tasks on the specific computer to which the group belongs.					Local groups provide the ability to assign users to authorized administrator and authorized user roles with unique local access restrictions based on the local group to which the user is assigned. Local groups support the FMT_SMR.1, Security Roles TOE Security Functional Requirement.
Administrators	Members of the Administrators group are allowed complete control over the entire computer. When a member server or a computer running Windows 2000 joins a domain, the Domain Admins group is added to the local Administrators group.				Stand-alone: Administrator Domain Members: Administrator Domain Admins	Supports assignment of administrative role with full administrative access rights to all local resources on a computer. Requirement: Do not add non-administrative accounts to this group.*
Backup Operators	Members can use Windows Backup to back up and restore the computer regardless of file system security.				None	Misuse of this account can violate FDP_ACF.1(a), Discretionary Access Control. A member of the Backup Operators group can extract files and directories for which the user would normally not have access. Membership in this group permits users to open any file for backup purposes, however, once the file has been opened for read access it can be redirected by the Backup Operator to any location. By default, users are allowed to backup and restore files for which they have the appropriate file and directory permissions without requiring membership in the Backup Operators group. The Administrator account already has full backup rights. Requirement: Do not add non-administrative accounts to this group.*
Guests	The Guest group offers limited access to resources on the system. Members cannot make permanent changes to their desktop environment. By default, the Guest user account for the computer is a member. This account is disabled by default.				Stand-alone Professional: Guest Stand-alone Server: Guest TsInternet User Domain Members: Add Domain Guests	Guest/anonymous accounts can violate FAU_GEN.2, User Identity Association, FIA_UAU.2, Authentication, and FIA_UID.2, User Identification Before Any Action. Requirement: Do not use this group. Remove all accounts including Guest from this group.
Power Users	Membership provides users with the ability to create and modify local user accounts on the computer and share resources, without giving the user complete control over the computer.				None	Supports assignment of user role supporting elevated user rights on a specific computer. This group provides administrative level privileges such as management of local user accounts and local resource management. Membership in this group by users who are not authorized administrators violates FMT_MTD.1(c), Management of User Attributes, FMT_MTD.1(d), Management of Authentication Data (for user created accounts), FMT_MTD.1(e), Management of Account Lockout Duration (for user created accounts), Management of Minimum Password Length (for user created accounts), and FMT_SMR.1, Security Roles to the extent that users would be privileges generally associated with an authorized administrator role. Requirement: Do not add non-administrative accounts to this group.*
Replicator	Members can configure file replication services. The directory replicator service is used to automatically copy files, such as user logon scripts, between Windows 2000-based computers.				None	Can be used in support of requirements identified in para 6.1.5.3, TFS Data Replication Consistency. Supports assignment of administrative role responsible for administering directory replication services within a computer. Requirement: Do not add non-administrative accounts to this group.*
Users	This group provides the user with the necessary rights to operate the computer as an end user, such as running applications and managing files. By default, Windows 2000 adds all new local user accounts to the Users group. When a member server or a computer running Windows 2000 joins a domain, the Domain Users global group, the Authenticated Users special group, and the INTERACTIVE special group are added to the local Users group.				Stand-alone: Authenticated Users INTERACTIVE (all new local users are added by default) Domain Members: Authenticated Users Domain Users INTERACTIVE (all new local users are added by default)	Supports assignment of user role supporting access to local resources on the computer. Requirement: Do not add accounts with potential for unauthenticated access (such as Guest) to this group.
System Groups	System groups do not have specific memberships that can be modified. Each is used to represent a specific class of users or to represent the operating system itself. These groups are created by Windows 2000 systems automatically, but are not shown in the group administration GUIs.
Anonymous Logon	Includes any user account that Windows 2000 did not authenticate.				All unauthenticated users.	Misuse of this account can violate FAU_GEN.2, User Identity Association, FIA_UAU.2, Authentication, and FIA_UID.2, User Identification Before Any Action. Requirement: Do not grant resource permissions or user rights to this account.
Authenticated Users	Includes all users with a valid user account on the computer or in Active Directory services.				All authenticated users.	Supports FAU_GEN.2, User Identity Association, FIA_UAU.2, Authentication, and FIA_UID.2, User Identification. Recommendation: Use the Authenticated Users group instead of the Everyone group to prevent anonymous access to a resource.
BATCH	A group that includes all users logged on through a batch queue facility.
CREATOR OWNER	Includes the user account for a user who created or took ownership of a resource. If a member of the Administrators group creates a resource, the Administrators group is the owner of the resource. This group is created for each sharable resource on Windows 2000 Server or Professional. A placeholder in an inheritable access control entry (ACE). When the ACE is inherited, the system replaces this SID with the SID for the object's creator.				Members of this group are users who create or take ownership of resources.	Supports FDP_ACF.1(a), Discretionary Access Control Functions through assignment of object owner attributes.
CREATOR GROUP	A placeholder in an inheritable ACE. When the ACE is inherited, the system replaces this SID with the SID for the primary group of the object's creator.
DIALUP	Includes any user who currently has a dial-up connection.				All dial-in users.	Requirement: Dial-up service support is not an objective of the TOE. Therefore, do not grant resource permissions or user rights to this account.
ENTERPRISE DOMAIN CONTROLLER	A group that includes all domain controllers in a forest that uses an Active Directory service.
Everyone	Includes all users who access the computer. Windows 2000 will authenticate a user who does not have a valid user account as Guest. The user automatically gets all rights and permissions assigned to the Everyone group. A group that includes all users, even anonymous users and guests.				Members of this group include all users accessing Windows 2000 Server or Professional locally, through the network, or through RAS. This includes authenticated and unauthenticated users. In essence, every user who accesses the system is a member of the Everyone group.	Misuse of this account can violate FAU_GEN.2, User Identity Association, FIA_UAU.2, Authentication, and FIA_UID.2, User Identification Before Any Action. Requirement: Do not assign resource permissions or user rights to this account. Use Authenticated Users or specific user accounts and groups where necessary
INTERACTIVE	Includes the user account for the user logged on locally at the computer. Members of the Interactive group gain access to resources on the computer at which they are physically located.				This group includes all users who log into Windows 2000 Server or Professional locally. Users who are connected across a network are not members of this group.
NETWORK	Includes any user with a current connection from another computer on the network to a shared resource on the computer.				This group includes all users who are connected to resources across a network, but does not include those who are connected interactively.
PROXY	This SID is not used in Windows 2000.
RESTRICTED	This SID is not used in Windows 2000.
SELF	A placeholder in an inheritable ACE on an account object or group object in Active Directory. When the ACE is inherited, the system replaces this SID with the SID for the security principal who holds the account.
SERVICE	A group that includes all security principals logged on as a service.
SYSTEM	Account used by the operating system to run services, utilities, and device drivers. This account has unlimited power and access to resources that even Administrators are denied, such as the Registry's SAM.					This account is used by Windows 2000 to execute security services such as TSF protection functions that are beyond the control of authorized administrators.
TERMINAL SERVER USER						Requirement: Terminal service support is not an objective of the TOE. Therefore, do not grant resource permissions or user rights to this account.

* It is not necessary to remove the corresponding group from DACLs of secured objects as long as this requirement is met.