Tidbits About the Login Process
Friday, October 17th, 2008Authenticating users is an important operating system function.
When you login to your computer, which begins when you press CTRL+ALT+DEL on the local keyboard, the Winlogon process (winlogon.exe) begins, and the Microsoft Graphical Identification and Authentication (MSGINA) DLL picks up the username and password to compare it against what is stored in the local accounts database (MSGINA picks this up and passes it back to Winlogon, who actually performs the work). This database is part of the registry. If your username/password combination is there, you log in. If not, you get a message asking you to try again.
Part of the logon process is to next find all of your individual settings stored on the computer and load all of this into RAM. These settings include your desktop colors, shortcuts, programs installed, and user rights associated with your logon profile.
The logon process assigns your user account a type of ‘license’ that stays with you throughout your logon session. This license is called a security identification (SID). Every object on your computer has its own SID. A SID is an alphanumeric string of variable length. It might look something like S-1-2-3 or it might be quite a bit longer.
For example, if you try to use the network to print in the college library, your SID is checked against the printer’s list of who can print. This list is an Access Control List, or ACL. If your user account is in the list, which is an Access Control Entry, or ACE, you get to print!
Further, your SID is checked every time you open a file/folder or use any hardware on your own computer. Each one of these objects has its own ACL and quickly determines whether or not you get to open/use the object. The ACL keeps track of the permissions associated with your SID.
Notice the use of two distinct terms in this discussion: user rights and permissions. MCSA candidates need to differentiate between these and understand that permissions apply to objects (examples are files, folders, printers, network shares, the registry, services, and group policy objects) a user (or other object) attempts to view, modify, or create. A Windows Object Manager manages this.
User rights are used to give permissions to user accounts. Yes, user accounts are a type of object, just like files and folders! However, user account objects are quite different from the other objects I’ve mentioned. An analogy might be that user accounts navigate to, open, and modify files but files do not navigate to, open, or modify user accounts.
Finally it is strongly recommended that you apply user rights to groups and not individual user accounts. Groups are special objects into which user accounts may be placed. We will discuss groups in a later discussion.