Running Windows 7 in Groups and Domains

In a homegroup or workgroup, a computer running Windows 7 has only local machine accounts. In a domain, a computer running Windows 7 has both local machine accounts and domain accounts. Windows 7 has two primary types of local user accounts:

Windows 7 includes User Account Control as a way to enhance computer security by ensuring true separation of standard user and administrator user accounts. Because of the User Account Control feature in Windows 7, all applications run using either standard user or administrator user privileges. Whether you log on as a standard user or as an administrator user, you see a security prompt by default whenever you run an application that requires administrator privileges. The way the security prompt works depends on Group Policy settings (as discussed in the section called “Optimizing User Account Control and Admin Approval Mode” in Chapter 5, Managing User Access and Security) and whether you are logged on with a standard user account or an administrator user account.

When you are logged on using a standard user account, you are asked to provide a password for an administrator account, as shown in Figure 1.3. In a homegroup or workgroup, each local computer administrator account is listed by name. To proceed, you must click an account, type the account's password, and then click Submit.

Figure 1.3. Prompting for administrator privileges

In a domain, the User Account Control dialog box does not list any administrator accounts, so you must know the user name and password of an administrator account in the default (log on) domain or a trusted domain to continue. When Windows prompts you, type the account name, type the account's password, and then click OK. If the account is in the default domain, you don't have to specify the domain name. If the account is in another domain, you must specify the domain and the account name by using the format domain\username, such as cpandl\williams.

When you are logged on using an administrator user account, you are asked to confirm that you want to continue, as shown in Figure 1.4. You can click Yes to allow the task to be performed or click No to stop the task from being performed. Clicking Show Details shows the full path to the program being executed.

Figure 1.4. Prompting for confirmation to continue

An important related change has to do with elevation of privileges. Elevation allows a standard user application to run with administrator privileges. You can run applications with elevated privileges by following these steps:

In a workgroup, Windows 7 displays a Log On screen at startup. All standard user and administrator accounts that you've created on the computer are listed on the Log On screen. To log on, click the account name you want to use. If the account is password protected, you must click the account name, type the account password, and then click the arrow button.

In a domain, Windows 7 displays a blank startup screen after initializing the operating system. You must press Ctrl+Alt+Del to display the Log On screen. By default, the last account to log on to the computer is listed in computer\username or domain\username format. To log on to this account, you type the account password and then click the arrow button. To log on to a different account, click the Switch User button, press Ctrl+Alt+Del, and then click Other User. The logon information you must provide depends on what type of account you are using.

Windows 7 supports fast user switching in domain, homegroup, and workgroup configurations. When a user is logged on to a computer running Windows 7, you can use fast user switching to allow another user to log on without requiring the current user to log off.

To switch users, press Ctrl+Alt+Del, and then click the Switch User button. In a workgroup, the Log On screen is displayed as at startup. In a domain, a screen appears with the message "Press Ctrl+Alt+Del To Log On," and you must press Ctrl+Alt+Del again to display the Log On screen.

Unlike Windows XP and earlier versions of Windows, Windows 7 provides fast and easy ways to manage user account passwords. You can easily perform the following tasks:

These tasks are discussed in the sections that follow.