ExamFinch.com My Study

Study guide

3.2 User Accounts, Groups & Access Control

Practice this exam

Google IT Support Professional Certificate Exam

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Program Overview & Technical Support Fundamentals

1.1 Certificate Overview & Core Hardware 1.2 PC Assembly, BIOS/UEFI & Boot Sequence 1.3 Troubleshooting Methodology & Customer Service

2 Chapter 2: The Bits and Bytes of Computer Networking

2.1 Network Models & Physical Layer 2.2 Network Layer & IP Addressing 2.3 Transport & Application Layer Protocols 2.4 Wireless, Remote Access & Network Diagnostics

3 Chapter 3: Operating Systems — Windows & Linux Power User Basics

3.1 OS Architecture & Shell Navigation 3.2 User Accounts, Groups & Access Control 3.3 Package Management & Software Deployment

4 Chapter 4: Operating Systems — Process Management, Filesystems & Scripting

4.1 Process Management & System Logging 4.2 Filesystem Types & Storage Management 4.3 Practical Shell Scripting & Automation

5 Chapter 5: System Administration & IT Infrastructure Services

5.1 Sysadmin Role & IT Policies 5.2 Core Infrastructure Services: DNS, DHCP & NTP 5.3 Directory Services: Active Directory & LDAP

6 Chapter 6: Cloud Services, Systems Management & Disaster Recovery

6.1 Cloud Models & Enterprise Storage 6.2 OS Imaging & Configuration Management 6.3 Backup Strategies & Disaster Recovery

7 Chapter 7: IT Security — Defense Against the Digital Dark Arts

7.1 Security Principles & Threat Landscape 7.2 Cryptography & Public Key Infrastructure 7.3 AAA, Network Defense & Incident Response

3.2 User Accounts, Groups & Access Control

Key Takeaways Explain This Topic AI

The Principle of Least Privilege (PoLP) mandates that users, service accounts, and processes are granted only the minimum access rights and permissions required to perform their explicit job functions.

Linux user and security records reside in /etc/passwd (account metadata, default shells), /etc/shadow (cryptographically salted password hashes and password aging parameters), and /etc/group (group definitions).

Linux file security enforces a 3x3 permission matrix: Read (4, r), Write (2, w), and Execute (1, x) across User Owner (u), Group (g), and Others (o), augmented by special bits: SUID (4000), SGID (2000), and Sticky Bit (1000).

Windows user administration utilizes Local Users and Groups (lusrmgr.msc) and PowerShell cmdlets (New-LocalUser, Add-LocalGroupMember), protected by User Account Control (UAC) which filters administrative tokens during standard interactive sessions.

Windows NTFS Access Control Lists (ACLs) follow strict evaluation rules: Explicit Deny overrides Explicit Allow, and when network Share permissions interact with local NTFS permissions over SMB, the Most Restrictive Permission wins.

Last updated: August 2026

User Accounts, Groups & Access Control

In modern multi-user enterprise computing environments, controlling access to files, processes, and system configurations is critical to maintaining data confidentiality, system integrity, and availability. System administrators must ensure that authenticated users have the exact level of access necessary to perform their roles—and no more. This chapter explores identity management, privilege elevation, and filesystem access control mechanics across both Linux and Windows operating systems.

  • 1. User & Group Security Foundations
  • The Principle of Least Privilege (PoLP)

The Principle of Least Privilege (PoLP) is a fundamental security concept stating that every user account, process, service, and program must operate using only the minimal set of privileges necessary to accomplish its legitimate purpose.

Prevents accidental system-wide damage caused by administrative human error.

Restricts the blast radius of malware infections and compromised application vulnerabilities.

Ensures regulatory compliance with enterprise security frameworks (e.g., ISO 27001, SOC 2, NIST 800-53).

Account Classifications

Superuser Accounts: Possess unrestricted, god-mode authority over the operating system.

Linux: The root account (User ID 0 ). root can modify any file, kill any process, load kernel modules, and bypass all standard permission checks.

Windows: The built-in Administrator account and the NT AUTHORITY\SYSTEM account (used by the operating system kernel and background core services).

Standard User Accounts: Created for human employees. Standard accounts have read/write access to their personal profile directories ( /home/username or C:\Users\Username ), but cannot install system-wide software, modify OS files, or alter other users' private data.

Service / Daemon Accounts: Non-interactive accounts utilized by background services and server software (e.g., www-data , nginx , mysql , sshd in Linux; NETWORK SERVICE , LOCAL SERVICE in Windows). These accounts are configured without interactive login shells to prevent unauthorized interactive access if the service is compromised.

Role-Based Access Control (RBAC) via Groups

A Group is a collection of user accounts managed as a single security principal. Instead of assigning individual file permissions to dozens of separate users, permissions are assigned directly to a group (e.g., developers , accounting , sysadmins ). Adding or removing a user from the group automatically updates their effective access rights, streamlining enterprise lifecycle management.

2. Linux User & Group Administration

Linux systems maintain user and group identity information across three core plaintext configuration files in the /etc directory. +-----------------------------------------------------------------------------+

  • | LINUX IDENTITY CONFIGURATION FILES |
  • | |
  • | /etc/passwd (World-readable: 0644 / -rw-r--r--) |
  • | +---------------------------------------------------------------------+ |
  • | | username:x:1001:1001:Alice Smith,Room 402:/home/alice:/bin/bash | |
  • | | [1] [2] [3] [4] [5] [6] [7] | |
  • | +---------------------------------------------------------------------+ |
  • | [1] Username [2] Password Placeholder ('x') [3] User ID (UID) |
  • | [4] Primary Group ID (GID) [5] GECOS/Comment [6] Home Directory [7] Shell |
  • | |
  • | /etc/shadow (Restricted Read: 0640 or 0600 - root / shadow group only) |
  • | +---------------------------------------------------------------------+ |
  • | | alice:$6$salt$hashed_str:19750:0:90:7::: | |
  • | | [1] [2] [3] [4][5][6][7][8][9] | |
  • | +---------------------------------------------------------------------+ |
  • | [1] Username [2] Salted Cryptographic Hash ($6$ = SHA-512) |
  • | [3] Days since epoch of last password change [4] Min days between changes |
  • | [5] Max days password valid [6] Warn days before expiry [7] Inactive days |
  • | [8] Account expiration date [9] Reserved flag |
  • | |
  • | /etc/group (World-readable: 0644 / -rw-r--r--) |
  • | +---------------------------------------------------------------------+ |
  • | | developers:x:1002:alice,bob,carol | |
  • | | [1] [2] [3] [4] | |
  • | +---------------------------------------------------------------------+ |
  • | [1] Group Name [2] Group Password Placeholder [3] Group ID (GID) |
  • | [4] Comma-separated list of secondary/supplementary group members |
  • +-----------------------------------------------------------------------------+
  • Linux Account Management Commands

useradd : Creates a new user account.

sudo useradd -m -s /bin/bash -c "Alice Smith" -g developers -G sudo alice

-m : Generates the home directory ( /home/alice ).

-s /bin/bash : Sets the default interactive login shell.

-c "..." : Sets the comment/GECOS full name.

-g developers : Assigns the primary GID.

-G sudo : Appends supplementary groups (e.g., administrative sudo group).

usermod : Modifies an existing user account.

sudo usermod -aG docker bob : Appends ( -a ) the user bob to the supplementary ( -G ) docker group. (Omitting -a when using -G will accidentally overwrite and remove the user from all other supplementary groups!)

sudo usermod -L alice : Locks an account (prepends ! to password hash in /etc/shadow ).

sudo usermod -U alice : Unlocks a locked account.

userdel : Deletes a user account.

sudo userdel -r alice : Deletes the user alice and recursively purges ( -r ) their home directory and mail spool.

groupadd & groupdel : Creates ( groupadd developers ) or deletes ( groupdel developers ) group entries.

passwd : Changes account passwords.

passwd : Allows standard users to change their own password.

sudo passwd alice : Allows administrators to reset a user's password.

sudo passwd -e alice : Forces alice to change her password immediately upon next login.

Privilege Escalation: su vs. sudo & visudo

su (Switch User): Switches the current terminal session to another user account (defaulting to root if no username is provided).

su : Retains the original user's environment variables and working directory.

su - (or su -l ): Starts a full login shell , completely clearing the environment and loading root's $PATH , environment variables, and home directory ( /root ).

Drawback: Requires sharing the central root password among multiple administrators, violating non-repudiation and auditability.

sudo (Superuser Do): Allows authorized users to execute specific administrative commands using their own personal password .

Maintains granular audit logs in /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL/Rocky).

Access is controlled via /etc/sudoers .

visudo : The mandatory utility used to edit /etc/sudoers . visudo locks the sudoers file against concurrent edits and validates syntax before saving, preventing syntax errors that would lock all administrators out of sudo access. # /etc/sudoers rule syntax:

  • # User/Group Hosts=(RunAs_Users:RunAs_Groups) Commands
  • alice ALL=(ALL:ALL) ALL
  • %sudo ALL=(ALL:ALL) ALL
  • %webadmins ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart nginx
  • 3. Linux File Permissions & Ownership

Every file and directory in Linux is bound to an Owner (User) and an owning Group . The operating system evaluates permissions using a 3x3 security matrix: User ( u ) , Group ( g ) , and Others ( o ) . +-----------------------------------------------------------------------------+

  • | LINUX FILE PERMISSION MATRIX |
  • | |
  • | - r w x r - x r - - 1 alice developers 4096 Aug 21 14:00 app.sh|
  • | | \_____/ \_____/ \_____/ | | | | | |
  • | [1] [2] [3] [4] [5] [6] [7] [8] [9] |
  • | |
  • | [1] File Type: '-' (Regular File), 'd' (Directory), 'l' (Symlink) |
  • | [2] Owner Permissions (rwx = 4+2+1 = 7) |
  • | [3] Group Permissions (r-x = 4+0+1 = 5) |
  • | [4] Others Permissions (r-- = 4+0+0 = 4) |
  • | [5] Hard Link Count |
  • | [6] User Owner ('alice') |
  • | [7] Group Owner ('developers') |
  • | [8] File Size in Bytes |
  • | [9] File Name |
  • +-----------------------------------------------------------------------------+
  • Permission Bit Values

Permission Symbol Octal Value Meaning for Regular Files Meaning for Directories

Read r 4 View/read the file's data contents. List the names of files inside the directory ( ls ).

Write w 2 Modify, edit, or overwrite file data. Create, delete, or rename files inside the directory.

Execute x 1 Execute file as a compiled binary or script. Enter, traverse, or cd into directory and access file inodes.

Important

Directory Execute Bit Rule: Having Read ( r ) permission on a directory allows you to view file names, but without Execute ( x ) permission, you cannot cd into the directory, read file metadata, or open files within it!

Changing Modes: chmod

Octal (Numeric) Mode: Combines octal values ( 4+2+1=7 , 4+0+1=5 , etc.).

chmod 755 script.sh ( rwxr-xr-x ): Owner has full control; Group and Others can read and execute.

chmod 644 document.txt ( rw-r--r-- ): Owner can read/write; Group and Others can read only.

chmod 600 id_rsa ( rw------- ): Owner can read/write; Group and Others have zero access (required for SSH private keys).

chmod 700 private_dir/ ( rwx------ ): Only the owner can access and traverse the directory.

Symbolic Mode: Targets specific classes ( u =user, g =group, o =others, a =all) with operators ( + add, - remove, = set).

  • chmod u+x deploy.sh (Adds execute permission for user owner)
  • chmod g-w,o-r secret.txt (Removes write from group, removes read from others)
  • chmod a+r public.html (Grants read access to everyone)
  • Changing Ownership: chown & chgrp

sudo chown alice file.txt : Changes user owner to alice .

sudo chown alice:developers file.txt : Changes user owner to alice and group to developers .

sudo chown -R www-data:www-data /var/www/html : Recursively ( -R ) updates ownership across an entire directory tree.

sudo chgrp developers file.txt : Changes group ownership only.

Special Permissions (SUID, SGID, Sticky Bit)

Beyond standard read/write/execute bits, Linux provides three specialized permission modes: +-----------------------------------------------------------------------------+

  • | SPECIAL PERMISSION BITS |
  • | |
  • | [SUID: Set Owner User ID] (Octal 4000) |
  • | - Applied to: Executable Binaries (e.g., /usr/bin/passwd) |
  • | - Mode Display: -rwsr-xr-x (User execute bit displays 's' or 'S') |
  • | - Function: Process executes with privileges of the FILE OWNER (root), |
  • | rather than the calling user, allowing safe privileged tasks. |
  • | |
  • | [SGID: Set Group ID] (Octal 2000) |
  • | - Applied to: Directories (collaborative team shared folders) |
  • | - Mode Display: drwxr-sr-x (Group execute bit displays 's' or 'S') |
  • | - Function: Newly created files inherit the PARENT DIRECTORY'S group, |
  • | rather than the creator's primary group. |
  • | |
  • | [STICKY BIT] (Octal 1000) |
  • | - Applied to: Shared World-Writable Directories (e.g., /tmp, /var/tmp) |
  • | - Mode Display: drwxrwxrwt (Others execute bit displays 't' or 'T') |
  • | - Function: Only the FILE OWNER or root can delete or rename a file, |
  • | preventing users from deleting each other's temporary files. |
  • +-----------------------------------------------------------------------------+
  • Setting SUID: sudo chmod 4755 /usr/local/bin/custom_tool or chmod u+s file
  • Setting SGID: sudo chmod 2775 /var/shared/devs/ or chmod g+s dir/
  • Setting Sticky Bit: sudo chmod 1777 /tmp or chmod +t /tmp
  • 4. Windows User Management & Security Architecture

Windows stores local user security accounts in the Security Accounts Manager (SAM) database registry hive ( C:\Windows\System32\config\SAM ). +-----------------------------------------------------------------------------+

  • | WINDOWS USER ACCOUNT CONTROL (UAC) |
  • | |
  • | [INTERACTIVE ADMINISTRATOR LOGON] |
  • | | |
  • | v |
  • | [LOCAL SECURITY AUTHORITY (LSASS.EXE)] |
  • | - Generates Full Administrator Access Token |
  • | - Filters Token: Strips administrative privileges & RID 500 rights |
  • | | |
  • | v |
  • | +---------------------------------------------------------------------+ |
  • | | STANDARD USER TOKEN (Default Explorer.exe & Child Application Shell)| |
  • | | - Can browse web, write to User Profile, read shared files | |
  • | | - CANNOT write to C:\Windows, modify registry HKLM, or install apps | |
  • | +---------------------------------+-----------------------------------+ |
  • | | |
  • | APPLICATION REQUESTS PRIVILEGED ACTION |
  • | v |
  • | +---------------------------------------------------------------------+ |
  • | | USER ACCOUNT CONTROL (UAC) CONSENT PROMPT (Secure Desktop Switch) | |
  • | | - Dimmed screen isolated from malware keystroke logging | |
  • | | - Click [YES] to elevate -> Application spawned with FULL ADMIN TOKEN| |
  • | +---------------------------------------------------------------------+ |
  • +-----------------------------------------------------------------------------+
  • Windows Administration Consoles & PowerShell

lusrmgr.msc : The Microsoft Management Console (MMC) snap-in for managing Local Users and Groups on Windows Pro/Enterprise editions.

  • PowerShell Local User Management Cmdlets: # Create a new local user with password
  • $Password = Read-Host -AsSecureString "Enter password"
  • New-LocalUser -Name "Alice" -Password $Password -FullName "Alice Smith" -Description "Developer Account"
  • # Add user to the local Administrators group
  • Add-LocalGroupMember -Group "Administrators" -Member "Alice"
  • # View local user accounts and status
  • Get-LocalUser | Select-Object Name, Enabled, LastLogon, PasswordRequired
  • # Disable a compromised account
  • Disable-LocalUser -Name "Bob"
  • User Account Control (UAC) Mechanics

User Account Control (UAC) mitigates the risk of malware executing unauthorized administrative actions. Even when an account belongs to the Administrators group, Windows logs the user in with a filtered standard user token by default.

When a program requires elevated privileges (e.g., modifying system files in C:\Windows\System32 or installing device drivers), Windows invokes the Application Information Service ( appinfo.dll ) .

The system transitions to the Secure Desktop (an isolated session immune to window messaging tampering) and presents a prompt:

Consent Prompt: For administrators (clicking Yes attaches the elevated administrative token).

Credential Prompt: For standard users (requires entering an administrator's credentials to elevate).

5. Windows NTFS Permissions & Share Access Control

Windows NT File System (NTFS) provides granular access control via Access Control Lists (ACLs) comprised of individual Access Control Entries (ACEs) .

NTFS Permission Hierarchy

NTFS Permission Level Capabilities Granted

Read View file contents, view folder file lists, inspect file attributes and permissions.

Write Overwrite file contents, create new files and subdirectories within a folder, alter attributes.

Read & Execute View contents and run executable programs and scripts. Inherited by default across folders.

List Folder Contents Identical permissions to Read & Execute, but applies strictly to folder objects.

Modify Encompasses Read, Write, and Execute, plus the authority to delete files and subdirectories.

Full Control Encompasses Modify, plus the authority to change NTFS permissions and take ownership of the object.

NTFS Inheritance & Conflict Resolution Rules

When evaluating access requests across multiple group memberships and inheritance chains, Windows applies strict precedence rules:

Explicit Deny (Configured directly on the object) overrides everything.

Explicit Allow (Configured directly on the object).

Inherited Deny (Inherited from a parent folder).

Inherited Allow (Inherited from a parent folder).

Cumulative Allow: If a user belongs to Finance (Read) and Auditors (Modify), their effective NTFS permission is Modify (the union of all Allow permissions). +-----------------------------------------------------------------------------+

  • | SHARE PERMISSIONS VS. NTFS PERMISSIONS |
  • | |
  • | [REMOTE CLIENT OVER NETWORK (SMB / CIFS)] |
  • | | |
  • | v |
  • | +-------------------------------------------------------+ |
  • | | NETWORK SHARE PERMISSIONS (Read, Change, Full Control)| |
  • | | Example: Share Permission = CHANGE | |
  • | +---------------------------+---------------------------+ |
  • | | |
  • | v |
  • | +-------------------------------------------------------+ |
  • | | LOCAL NTFS PERMISSIONS (Read, Modify, Full Control) | |
  • | | Example: Local NTFS Permission = READ | |
  • | +---------------------------+---------------------------+ |
  • | | |
  • | v |
  • | +-------------------------------------------------------+ |
  • | | EFFECTIVE ACCESS = MOST RESTRICTIVE WINS | |
  • | | Result: READ ONLY (Change INTERSECT Read = Read) | |
  • | +-------------------------------------------------------+ |
  • +-----------------------------------------------------------------------------+
  • Network Share Permissions vs. NTFS Permissions

Share Permissions: Applied only when accessing resources over the network via Server Message Block (SMB/Shared Folders). Configurable options: Read , Change , and Full Control .

NTFS Permissions: Applied consistently whether the user logs in locally at the console or connects remotely over the network.

Effective Permission Calculation Rule: When accessing a shared folder over the network, Windows evaluates both sets of permissions independently. The Most Restrictive Permission Wins (the intersection of Share and NTFS rights).

Loading diagram... Windows NTFS Permission Precedence Resolution Algorithm