Local Users and Groups in Windows 2000 Professional

The Local Users and Groups Microsoft Management Console (MMC) snap-in in Windows 2000 Professional is an administrative utility used to manage local user accounts and local security groups. Stored in the workstation's local Security Accounts Manager (SAM) database, these accounts define who can log on to the specific machine and determine the permissions and system rights each user holds.

User Account Management

The primary role of the snap-in is creating and maintaining individual local user accounts. Administrators can:

• Create new user accounts, assign usernames, and define initial passwords.
• Require users to change their passwords at next logon.
• Prevent users from changing their passwords or configure passwords to never expire.
• Disable or unlock accounts that have been locked out due to failed logon attempts.
• Configure user profile paths, logon scripts, and home directories.

Group Account Management

Local Users and Groups allows administrators to organize individual accounts into security groups to simplify permissions management. Windows 2000 Professional includes built-in groups—such as Administrators, Power Users, Users, Backup Operators, and Guests—each pre-configured with distinct system privileges. Administrators can also create custom local groups and add either local user accounts or Active Directory domain accounts (if the machine is joined to a domain) into these groups.

Access Control and Security

By modifying memberships within the snap-in, administrators control access to local computer resources, including files, folders, printers, and system settings. Group membership determines user capabilities, ranging from installing software and altering system configuration (Administrators) to standard application usage without administrative privileges (Users).

Scope and Access

The snap-in operates strictly on the local machine's SAM database and cannot be used to manage Active Directory domain objects. It is accessed either as a standalone console by running lusrmgr.msc or as a sub-component within the standard Computer Management tool (compmgmt.msc).