Chapter 11 — Operating systems

Lesson map

Lesson 11 published. Map, example, EX031.

flowchart TD
  N0["Learning outcomes"]
  N1["11.1 Users and administrators"]
  N2["11.2 Device sign-in"]
  N3["11.3 Local administrator passwords"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX031"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["11.1 Users and administrators"]
  N2["11.2 Device sign-in"]
  N3["11.3 Local administrator passwords"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX031"]

[Learning outcomes]
    |
    v
[11.1 Users and administrators]
    |
    v
[11.2 Device sign-in]
    |
    v
[11.3 Local administrator passwords]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX031]

Learning outcomes

You will (1) explain user and administrator accounts on laptops; (2) describe local accounts and device sign-in; (3) reduce unnecessary admin rights.

11.1 Users and administrators

Operating systems separate standard users from administrators. Administrators can install software and change security settings; standard users cannot. If a member of staff works all day as an administrator, any harmful file they open gets administrator power too. At Greenhill, Elena finds that about a third of laptops let their main user act as an administrator, mostly for historical reasons. She recommends standard accounts for daily work, with a simple request process when someone genuinely needs software installed. Requests are logged and reviewed monthly.

11.2 Device sign-in

Greenhill laptops are joined to the office suite's device management, so staff sign in with their work accounts. This means disabling a leaver's account stops them signing in to any managed laptop. Elena checks for laptops not enrolled in device management, finding four older machines with only local accounts. Those machines would let a leaver keep signing in if they still had one. She lists them for the IT lead to enrol or retire, closing a gap that account disabling alone cannot reach.

11.3 Local administrator passwords

Each laptop also has a built-in local administrator account for emergencies. If every laptop uses the same local password, knowing it on one machine opens all of them. Elena recommends a tool built into the device management service that gives each laptop a unique, automatically rotated local administrator password, stored centrally and logged when viewed. This is a small configuration change with a large effect, and it shows how operating system settings are part of identity and access management. The IT lead approves the change.

Worked example

Elena finds 46 of 140 laptops with daily administrator rights and four unenrolled laptops, and recommends standard accounts, enrolment and unique local administrator passwords.

Synthetic case. Laptops and counts are synthetic.

Errors and limits

Disabling a leaver's cloud account does not stop sign-in on laptops that use only local accounts.

Exercises

• EX031 — Admin daily risk. Why is working daily as administrator risky?
  Show marking criteria

  Rubric: 3 = harmful files get admin power;; 2 = power;; 1 = slow;; 0 = none.
• EX032 — Unenrolled laptops. How many unenrolled laptops did Elena find?
  Show marking criteria

  Rubric: 3 = four;; 2 = 4;; 1 = vague;; 0 = none.
• EX033 — Local password fix. What fixes shared local administrator passwords?
  Show marking criteria

  Rubric: 3 = unique, rotated, centrally stored and logged passwords;; 2 = unique;; 1 = vague;; 0 = none.

Synthesis

Standard daily accounts, managed device sign-in and unique local administrator passwords extend IAM to laptops.

Continue studying — chapter 11 of 40

← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →