If you haven't used Windows well-known security principals, you might not realize how powerful and complex they can be. Because Microsoft added new well-known security principals to Windows Server 2003, getting up to speed on using these entities to administer the access control settings of Windows resources is a good idea. But before I go into detail about their administration, I want to briefly review security principals generally and well-known security principals specifically. Part 2 of this article will explore the details of administering these complex entities.
A Windows security principal is an authenticated entity that uses the resources (e.g., files, printers), applications, or services that a Windows computer hosts. A security principal can be a user, computer, or group of users or computers. Each security principal has a unique identifier that's known as a SID. For an introduction to fundamental Windows security concepts, see "A Matter of Trust," July 2005, InstantDoc ID 46591, and "Logon Rights: the Heart of Windows Access Control," August 2005, InstantDoc ID 46870. . . .
