Microsoft Windows Home Server 2011 : Modifying User Accounts

After you’ve added a user to Windows Home Server, you can modify the account as needed via the Windows Home Server Dashboard. You can view the current account properties, change the account password, disable the account, and remove the account. These next few sections take you through these and other account chores.

Before continuing, I should point out that Windows Home Server does come with other tools for modifying user accounts. The server’s Windows Server 2008 underpinnings mean that two advanced user account tools are available:

• The User Accounts dialog box—Select Start, Run, type control userpasswords2, and click OK (see Figure 1). You saw in the previous section that you can use this dialog box to set up an automatic logon. You can do the same thing for the Windows Home Server machine. You can also display the Advanced tab and then click Advanced to display the Local Users and Groups snap-in, discussed next. Other than that, however, to avoid breaking Windows Home Server’s user accounts, you shouldn’t use the User Accounts dialog box for any other account-related chores.
  
  

  Figure 1. In Windows Home Server, you can do only a limited number of things with the User Accounts dialog box.

  

  
  

  Caution

  Set up Windows Home Server with an automatic logon only if security is absolutely not a problem in your house. Otherwise, you won’t be able to lock out unauthorized users from the server, and the results could be catastrophic (depending on the age and rebelliousness of the users in your house).

• The Local Users and Groups snap-in—Click the Server Manager icon in the taskbar, click Configuration, click Local Users and Groups, and then click Users (see Figure 2). This snap-in plays a bit nicer with Windows Home Server than it does the User Accounts dialog box. For example, you can use this snap-in to disable or enable an account, change an account’s full name, and give a user access to remotely access the server. You can also make an account a member of a group not used by Windows Home Server. However, some actions—such as renaming an account—can break the account in Windows Home Server, so again you’re mostly better off using the Home Server Dashboard.
  
  

  Figure 2. You can use the Local Users and Groups snap-in for some account-related chores, but use caution.

  
  

Viewing Account Properties

When you open the Home Server Dashboard and click the Users icon, you see a list of users with accounts on the server. For each user, you see the full name, the logon name, whether the user has remote access (Allowed or Not Allowed), and the current account status (Active or Inactive). To see more properties, click the account and then click View the Account Properties. Windows Home Server displays the accounts property sheet, as shown in Figure 3.

Figure 3. The property sheet for a Windows Home Server user account.

Tip

For faster service, you can also display the user’s property sheet either by double-clicking the account or by right-clicking the account and then clicking View the Account Properties.

Here’s a quick look at some of the more basic chores you can perform from this dialog box:

• Changing the full name—Edit the First Name and Last Name text boxes.
  
  
• Configuring remote access—Display the Remote Web Access tab. If you select the Allow Remote Access option, use the list to choose what you want the user to be able to access remotely: shared folders, home computers, and so on.
  
  
• Apply shared folder access—Display the Shared Folders tab and then use the list beside each available share to set the access level to Full Access, Read Only, or No Access.
  
  

Changing the Account Password

If you want to change a user’s password, here are the steps to follow:

1.	Launch the Windows Home Server Dashboard.
2.	Select the Users section.
3.	Click the user you want to modify.
4.	Click Change the User Account Password. Windows Home Server displays the Reset User Password dialog box. Note If you happen to have the user’s property dialog box open, you can also change the password by clicking Change the User Account Password in the General tab.
5.	Type the new password in the Password text box. When you’re done, make sure that you see check marks in the Password Requirements area for both the Length and Complexity, meaning that your new password meets or exceeds the Windows Home Server password policy requirements.
6.	Retype the password in the Confirm Password dialog box.
7.	Click Change Password. Windows Home Server displays a dialog box to let you know that it changed the password.
8.	Click OK.

Tip

Somewhat unusually, when you change a user’s password in the Windows Home Server Dashboard, the program doesn’t ask you to first enter the user’s current password. Although atypical, it can also come in handy if you (and the user) forget an account’s password. Just follow the steps in this section to create a new password for the account. On the downside, note that you won’t be able to synchronize the new password with the user’s client account because Windows Home Server requires you to provide the forgotten client account password to perform the synchronization.

Disabling a User Account

If you want to prevent an account from accessing the network temporarily, you can disable it by following these steps:

1.	Launch the Windows Home Server Dashboard.
2.	Select the Users section.
3.	Click the user you want to disable.
4.	Click Deactivate the User Account. Windows Home Server asks you to confirm.
5.	Click Yes.

Note

If you have the user’s property dialog box open, you can also deactivate the user by selecting the General tab and then deactivating the User Is Active check box.

When the user tries to access the Windows Home Server shares, he sees the message shown in Figure 4.

Figure 4. Disabled users see this message when they try to access the Windows Home Server shared folders.

Enabling a User Account

If you’ve disabled a user account in Windows Home Server, here are the steps to follow to enable the account and once again allow it to access the network:

1.	Launch the Windows Home Server Dashboard.
2.	Select the Users section.
3.	Click the user you want to disable.
4.	Click Activate the User Account. Windows Home Server asks you to confirm.
5.	Click Yes.

Note

If you have the user’s property dialog box open, you can also activate the user by selecting the General tab and then activating the User Is Active check box.

Enabling the Guest Account

What do you do if you have someone visiting your place and that person wants to, say, access some media on Windows Home Server with his computer? You could allow the person to log on using an existing account, but that might not be reasonable due to privacy or security concerns. Another option would be to set up a user account for that person, but that seems like overkill, particularly for a person on a short visit.

A better solution would be to enable the Guest account and allow your visitor to log on under that account. Here are the steps to follow:

1.	Launch the Windows Home Server Dashboard.
2.	Select the Users section.
3.	Click the Guest user.
4.	Click Activate the User Account. Windows Home Server asks you to confirm.
5.	Click Yes.

Removing a User Account

Windows Home Server supports up to 10 user accounts, which ought to be plenty for most households, with only the odd Brady Bunch–like clan bumping up against this ceiling. Still, that doesn’t mean you should just leave unused accounts lying around the Windows Home Server Dashboard. Dormant accounts clutter the interface and waste space on the server’s shares.

If you have a Windows Home Server user account that you no longer need, follow these steps to delete it:

1.	Open the Windows Home Server Dashboard.
2.	Click the Users icon.
3.	Click the user you want to delete.
4.	Click Remove the User Account. The Delete a User Account dialog box appears.
5.	Click Delete Account.

Adding a User to a Group

You learned earlier that Windows Home Server adds each user to the Users group and to the Remote Desktop Users group if you give that person remote access to the network. It’s unlikely that you’ll need to add a user to any other group defined by Windows Home Server, but it’s not unheard of. For example, if you want to script the Windows Home Server machine from a client machine on the network using Windows Management Instrumentation (WMI), you need to add that user to the Administrators group. 

Just in case it comes up, here are the steps to follow to add a user to a security group:

1.	On the server, select Start, right-click My Computer, and then click Manage to open the Computer Management snap-in.
2.	Select Local Users and Groups, Users to display the list of users on the server.
3.	Double-click the user you want to work with to open that user’s property sheet.
4.	Display the Member Of tab.
5.	Click Add to display the Select Groups dialog box.
6.	Type the name of the group to which you want the user added. Tip If you’re not sure of the exact group name, click Advanced and then click Find Now to display a complete list of the available groups. Click the group you want to use, and then click OK.
7.	Click OK. Windows Home Server returns you to the user’s property sheet and adds the group to the Member Of list.
8.	Click OK.

Allowing a User to Log On to the Windows Home Server Desktop

For security purposes, it’s a good idea to allow just the Administrator account to access the Windows Home Server desktop. (Other users can log on to Windows Home Server remotely, but they only see the Windows Home Server Dashboard.) However, if you really need to allow another user to access the desktop, you can configure Windows Home Server to allow this. You can configure the user for a local logon (sitting at the Windows Home Server computer) or a remote logon (from another computer or over the Internet).

Caution

If you’re going to allow a user access to the Windows Home Server desktop, be sure to assign a strong password to that user’s account.

Technically, it’s the Administrators group that has permission to log on to Windows Home Server locally and remotely. Therefore, the easiest way to give someone the same permissions is to add that account to the Administrators group. (Refer to the previous section “Adding a User to a Group.”)

Allowing a User to Log On Locally

To give a user permission to log on locally, follow these steps:

1.	Log on to Windows Home Server.
2.	Select Start, Administrative Tools, Local Security Policy. The Local Security Settings snap-in appears. Tip You can also open the Local Security Setting snap-in by selecting Start, Run to open the Run dialog box, typing secpol.msc, and then clicking OK.
3.	Open the Security Settings, Local Policies, User Rights Assignment branch.
4.	Double-click the Allow Log On Locally policy.
5.	Click Add User or Group to display the Select Users or Groups dialog box.
6.	Type the user’s name, and then click OK to return to the policy’s property sheet.
7.	Click OK.

Allowing a User to Log On Remotely

To give a user permission to log on remotely, you have two choices:

• Follow steps 1 through 7 from the previous section, but instead of adding the user to the Allow Log On Locally policy, add the user to the Allow Log On Through Remote Desktop Services policy.
  
  
• Add the user via the Remote Desktop settings.
  
  

For the latter, here are the steps to follow:

1.	Log on to Windows Home Server.
2.	Select Start, right-click Computer, and then click Properties.
3.	Click the Remote Settings link. The System Properties dialog box appears with the Remote tab displayed.
4.	Click Select Users. The Remote Desktop Users dialog box appears.
5.	Click Add to open the Select Users dialog box.
6.	Type the user’s name, and then click OK to return to the Remote Desktop Users dialog box.
7.	Click OK.