For a detailed description of the terms used, refer to the Microsoft MSDN documentation.
A group that includes all users, even anonymous users and guests. Membership is controlled by the operating system.
A placeholder in an inheritable access control entry (ACE). When the ACE is inherited, the system replaces this SID with the SID for the object's current owner.
A placeholder in an inheritable ACE. When the ACE is inherited, the system replaces this SID with the SID for the primary group of the object's current owner. The primary group is used only by the POSIX subsystem.
SID not used in Windows 2000.
SID not used in Windows 2000.
A group that implicitly includes all users who are logged on to the system through a dial-up connection. Membership is controlled by the operating system.
A group that implicitly includes all users who are logged on through a network connection. Membership is controlled by the operating system.
A group that implicitly includes all users who have logged on through a batch queue facility such as task scheduler jobs. Membership is controlled by the operating system.
A group that includes all users who have logged on interactively. Membership is controlled by the operating system.
A group that includes all security principals that have logged on as a service. Membership is controlled by the operating system.
A user who has logged on anonymously.
SID not used in Windows 2000.
A placeholder in an ACE on a user, group, or computer object in Active Directory. When you grant permissions to Principal Self, you grant them to the security principal represented by the object. During an access check, the operating system replaces the SID for Principal Self with the SID for the security principal represented by the object.
A group that includes all users whose identities were authenticated when they logged on. Membership is controlled by the operating system.
A group that includes all users who have logged on to a Terminal Services server. Membership is controlled by the operating system.
A service account that is used by the operating system.
A built-in group. After the initial installation of the operating system, the only member of the group is the Administrator account. When a computer joins a Windows domain, the Domain Admins group is added to the Administrators group. When a manager becomes a domain controller, the Enterprise Admins group also is added to the Administrators group. The Administrators group has built-in capabilties that give its members full control over the system. The group is the default owner of any object that is created by a member of the group.
A built-in group. After the initial installation of the operating system, the only member is the Authenticated Users group. When a computer joins a Windows domain, the Domain Users group is added to the Users group on the computer. Users can perform tasks such as running applications, using local and network printers, shutting down the computer, and locking the computer. Users can install applications that only they are allowed to use if the installation program of the application supports per-user installation.
A built-in group. By default, the only member is the Guest account. The Guests group allows occasional or one-time users to log on with limited privileges to a computer's built-in Guest account.
A built-in group. By default, the group has no members. This group does not exist on domain controllers. Power Users can create local users and groups; modify and delete accounts that they have created; and remove users from the Power Users, Users, and Guests groups. Power Users also can install most applications; create, manage, and delete local printers; and create and delete file shares.
A built-in group that exists only on domain controllers. By default, the group has no members. By default, Account Operators have permission to create, modify, and delete accounts for users, groups, and computers in all containers and organizational units (OUs) of Active Directory except the Builtin container and the Domain Controllers OU. Account Operators do not have permission to modify the Administrators and Domain Admins groups, nor do they have permission to modify the accounts for members of those groups.
A built-in group that exists only on domain controllers. By default, the group has no members. Server Operators can log on to a manager interactively; create and delete network shares; start and stop services; back up and restore files; format the hard disk of the computer; and shut down the computer.
A built-in group that exists only on domain controllers. By default, the only member is the Domain Users group. Print Operators can manage printers and document queues.
A built-in group. By default, the group has no members. Backup Operators can back up and restore all files on a computer, regardless of the permissions that protect those files. Backup Operators also can log on to the computer and shut it down.
Not used in Windows 2000. In Windows NT domains, it is a built-in group used by the File Replication service on domain controllers
| Copyright © 2014 CA Technologies. All rights reserved. |
|