Windows server 2008 security technology detailed

If a process must run regardless of whether the user is logged in, then the process is loaded as a service. Chapter 1: The Subject, the User, and the Role System security, in most cases, is the relationship between the subject and the object. The security principal is all account holders (users, groups, and computers) that have a secure identifier SID and are able to access resources. User: Local user (created in the Security Account Manager SAM database. Generally DC does not have a local user, there is only a directory recovery mode) and domain users. The biggest change since Windows 2000 was Active Directory. SID: uppercase letter S+ revision level (generally 1) + issuing authority (0 unknown, 1 all users, 2 login users, 3 creation or owner, 5 operating system itself) + first sub-authority (currently up to 4 , 5 login sessions, 6 services, 21 not unique, 32 built-in, 80 services) + remaining sub-licensing agencies + relative identifiers (representing users or computers). Such as: S-1-5-21-153416595923-165138082-500 (the SID of this domain starts with S-1-5-21-153416595923-165138082, plus the relative identifier to indicate the user). The SID of the service begins with S-1-5-80 and ends with the sub-issuer serial number based on the service name. This means that the SID of this service is the same on all computers. To find the SID of the service <FOO”, use the sc showsid command: sc showsid foo. Built-in security identifier is the same on all computers, built-in relative identifier: 500 administrator 501 guest 502 service account 512 domain administrator 513 domain user 514 domain guest 515 domain computer 516 domain controller 544 built-in administrator 545 built-in user 546 built-in guest.