When you create to use a recount in 80.
You also configure all this situated account properties.
You must define the attributes that allow the user to assign a name by using the account in addition
to a few other attributes because you can associate the user object with many attributes.
It's important that you understand what these attributes are and how you can use them in your organization.
You can configure user attributes by use an Active Directory administrative center or Active Directory
user or send computers or Windows power shell or the D S mod to.
Please note that the attributes associated with a user recount are defined as part of the ADF schema
which members of the schema admin security group can modify the schema does not often change.
However introduce on an enterprise level program such as Microsoft Exchange Server requires Magnitsky
my changes.
These changes enable objects including the user object to have additional attributes.
Now let's take a closer look at attribute categories the attributes of a user object fall into several
broad categories.
These categories appear in the navigation pane of the user properties dialog box in Active Directory
administrative center.
So I'll open an account and review all the attribute categories.
The first category is account in addition to the user's name properties which are first name middle
initial last name full name and to the user's various log names which are user you can log onto user
same account name log on.
You can configure the following additional properties log on ours.
This property defines when the user can use the account to access domain computers you can use the weekly
calendar or style view to define.
Log on permitted hours and log on denied hours.
The next one is log on to use this property to define which computers a user can use to sign into the
domain specify the computer's name and add it to a list of allowed computers.
The next one is account expire.
This failure is useful when you want to create a temporary user account.
For example you might want to create user accounts for interns who will be able to use the computers
in your organizations for just one year.
You can set the account expiration date in advance.
No one can use the account after the expiration date until an administrator reconfigure a set manually.
The next one is user must change password.
Next log on this property enables you to force users to reset their own password the next time they
sign in.
This is something you might enable after you reset a user response for the next property smartcard is
a required for interactive log on.
This value resets the user response effort to a complex random sequence of characters and sets a property
that requires that the user use a smartcard to authenticate your own log on the next one is password
never expires.
This is a to that you normally use with service accounts that is those accounts that services use and
not regular users.
By setting this value you must remember to update the password manually on a periodic basis.
However the system does not force you to do this at a pre-determined turmoil.
Consequently the account can never be locked out due to the password to expiration a feature that is
particularly important for a service account.
Let's move on to the next one which is user can not change paths for you use this option generally for
a service account.
The next one is stored password by using reversible encryption.
This policy provides support for programs that to use protocols that require knowledge of the user response
effort for authentic creation purposes storing passwords by using reversible encryption is essentially
the same as storing plain text versions of the passwords.
For this reason you should never enable this policy unless program requirements outweighs the need to
protect password information.
This policy is mandatory when you use challenge handshake authentication protocol or sharp authentication
through remote access or Internet authentication service.
It is mandatory when use in digester syndication in internet information services.
The next option is a county's trusted for delegation.
You can use this property to allow its source account to impersonate a standard user to access network
resources on behalf of a user.
So these were the options for the account property.
We've also got organization property.
This includes properties such as the users display name office email address various contact telephone
numbers management structure department turned organization names addresses and titles appropriate.
The next one is member of use this section to define group membership for the user password sentence.
This section includes password surgeons that apply directly to the user profile.
Use this section to configure a location for the user's personal data and to define a location in which
to save the user's desktop profile.
When he or she logs out the next one is policy.
Use this authentication policies to control Gerber ticket Grant and ticket life times and the authentication
access control for a specific account such as high level administrative accounts sila.
Use this section for authentication policies Silas which are the containers to which you can assign
a user account you can assign authentication policies to these silence and extensions.
This section exposes many additional user properties most of which do not normally require manual configuration.