Local Computer Account Management at Domain Level

• US 20100241668A1
• Filed: 03/17/2009
• Published: 09/23/2010
• Est. Priority Date: 03/17/2009
• Status: Abandoned Application

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Goddard, Steven F., Xie, Jianhui, Susanto, Ferry, Liptack, Michael K.
• Application Number:
  US12/406,026
• Publication Number:
  US 20100241668A1
• Time in Patent Office: Days
• US Class Current: 707/784
• CPC Class Codes: G06F 21/305 by remotely controlling device operation
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 67/04 specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/75 Indicating network or usage conditions on the user display

Abstract

A domain level database containing domain user permission settings may contain local device permission settings for domain users. For each of the local devices attached to the domain, a client service may periodically query the domain database and receive local permission settings for individual domain users. The local permission settings may affect access and availability of certain local resources and actions to the domain users. The client service may update a locally maintained database that may be used by a local security management system to permit or deny access to local resources and local actions to individual users when those users are logged onto the local device.

Claims

1. A system comprising:

a domain server having a domain database, said domain database comprising;

user metadata for a plurality of domain users, said user metadata comprising domain level permissions for each of said domain users;

device metadata for a plurality of local devices, said device metadata comprising local permission settings for said domain users;

a plurality of local devices, each of said local devices comprising;

a local security management database comprising permission settings for local users on said local device;

a local security management system configured to permit or deny access to local resources based on said permission settings in said local security management database; and

a security management updater configured to receive a set of local permission settings for said domain users for said local device, and update said local security management database with said local permission settings for each of said domain users for said local device.

2. The system of claim 1, said domain database being an LDAP database.

3. The system of claim 1, said local security management system being further configured to permit or deny access to said local device based on said permission settings.

4. The system of claim 1, said local permission settings being defined for one of said domain users by assigning said domain user as a member of a group.

5. The system of claim 4, said domain database having a plurality of local permission groups, each of said local permission groups having a set of permissions.

6. The system of claim 5, one of said local permission groups being an administrator group.

7. The system of claim 4, said domain user being assigned to a plurality of groups.

8. The system of claim 1, said domain users for said local device being a subset of said domain users as defined in said domain database.

9. The system of claim 1, said security management updater being configured to query said domain database.

10. The system of claim 9, said security management updater being configured to query said domain database on a periodic basis.

11. The system of claim 9, said security management updater being configured to query said domain database while one of said domain users is logged onto said local device.

12. The system of claim 1, said security management updater further configured to receive said local permission settings for a subset of said domain users having non-default permissions, and said local security management system further configured to use a set of default permissions for those domain users not in said subset.

13. A method performed on a local device, said method comprising:

on a predetermined frequency, performing a query to a domain database, said domain database comprising;

user metadata for a plurality of domain users, said user metadata comprising domain level permissions for each of a first plurality of domain users;

device metadata for said local device, said device metadata comprising local permission settings for a second plurality of said domain users;

receiving a set of local permission settings for each of said second plurality of said domain users;

for each of said second plurality of said domain users, storing said set of local permission settings in a local security database; and

permitting one of said second plurality of said domain users access to local device resources according to said local permission settings.

14. The method of claim 13, said second plurality being equal to said first plurality.

15. The method of claim 13, said local device resources comprising local administrator privileges.

16. The method of claim 13, said permitting being performed when said one of said second plurality of domain users logs onto said local device.

17. The method of claim 13, said local permission settings further comprising passwords for said second plurality of domain users.

18. A method comprising:

updating a database, said database comprising;

user metadata for a plurality of domain users, said user metadata comprising domain level permissions for each of a first plurality of domain users;

device metadata for a first plurality of local devices, said device metadata comprising local permission settings for said domain users; and

said updating comprising changing said local permission settings for a subset of said domain users for a second plurality of said local devices; and

for each of said second plurality of local devices, receiving a query and responding to said query with said local permission settings for said domain users, said local permission settings being used by said local devices to update a local permission database and to change access permissions to local resources for said domain users on said local device.

19. The method of claim 18, said database being an LDAP database, said device metadata comprising an extension to said LDAP database.

20. The method of claim 18, said subset of domain users having administrator privileges on said local devices.