Logon Rights: The Heart of Windows Access Control

The Windows access-control subsystem, the system that determines which users can access which resources and how they can access these resources, is rooted on the concepts of permissions and user rights. Permissions are related to objects--for example, permissions to print a file, create folders, and add a user object to Active Directory (AD). User rights are related to a Windows system as a whole--for example, the user right to log on to a Windows system or to change the system clock.

Windows user rights comprise two categories: user privileges and logon rights. User privileges, such as Change the System Time and Shut down the System, let you control access to system resources and system-related operations. Logon rights control which user accounts can log on to a Windows computer and how a user account can log on to a system. (For more information about user accounts and Windows logon procedures, see "A Matter of Trust," July 2005, InstantDoc ID 46591.) Here, I discuss how to use Windows logon rights as an access-control tool, and I offer an explanation of the different logon rights and tips for using them. . . .