2 - Windows Security Authorities and Principals

Abstract

This chapter focuses on two building blocks of Windows Server 2003 and Windows Server 2003 R2 operating system security: security authorities and security principals. This discussion covers the concepts of security, domain, security identifier, domain controller, logon name, LSA, and LSA policy. In an OS, trust is embodied and materialized by security authorities. A security authority reigns over a kingdom of shared resources and uses a database to store the security related information that is needed to allow or deny access to the resources. OS users trust security authorities because they believe they can adequately secure the access to shared resources. Bringing multiple resources together in a kingdom ruled by a security authority facilitates security policy enforcement and provides ease of use to both the users and administrators of an OS. In theWindows OS, two types of security authorities are dealt with: local and domain. Only windows domain authorities should be leveraged while using Windows because domains ease security administration and close possible security holes. The local security authority (LSA) plays a crucial role in the authentication and authorization security processes which includes tasks like security principal authentication, credential validation, and access token generation. Physically, the LSA is an OS subsystem running in OS user mode. Whereas, A Windows domain is a management boundary, that is, an administrative grouping of users, machines, and resources that can be managed by the same domain administrators. The chapter details the concept of Domain controller, LSA database, and LSA secrets. The discussion also includes principal identifiers, security identifiers, account management (domain account management and local account management), key window accounts, and password credentials.