# User Authentication and Access Control

> Chapter 7 of the Courseiva A-PLUS-220-1202 curriculum — https://courseiva.com/learn/a-plus-220-1202/user-authentication-and-access-control

**Official objective:** 2.2 — Given a scenario, implement and configure user authentication and access controls.

## Introduction

How do you stop the wrong people from accessing a computer, a file, or a network while letting the right people in? That is the core problem that user authentication and access control solves, and it is a major topic on the 220-1202 exam. Getting these concepts wrong on the job leads to data breaches and security incidents, so understanding them is essential for passing the exam and for your future IT career.

## The Apartment Building Key Fob Analogy

An apartment building key fob is the physical representation of user authentication and access control. The building has a front door, a gym, a laundry room, a rooftop, and individual apartment doors. The key fob is not just one key; it is a programmable chip that holds a specific set of permissions. When you move in, the building manager sets up your fob. She does not give everyone the same fob. Your fob might open the front door and your specific apartment door, but not the gym if you have not signed up for a membership. This setup is authentication (the fob proves you are a resident) and authorisation (the system knows exactly which doors you are allowed to open).

The apartment manager uses a central computer to manage all fobs. If a resident loses their fob, she can deactivate that specific fob remotely. The next day, the lost fob is useless. If a new tenant moves into apartment 3B, she issues a new fob and configures it to open the front door and 3B’s door only. The previous tenant’s fob is deactivated. This is exactly how an IT system manages user accounts and permissions. When an employee leaves a company, an IT administrator disables their account. When a new employee starts, the administrator creates a new account and grants access only to the resources that particular employee needs.

The fob also demonstrates the principle of least privilege. The cleaner does not need a fob that opens the rooftop or the private storage lockers. They only need access to the common areas and the cleaning supply closet. Giving them more access creates a security risk. A rogue cleaner could theoretically steal items from the rooftop or a storage locker. In the IT world, this exact principle prevents data breaches. A junior accountant does not need access to the CEO’s payroll file. The key fob analogy maps perfectly to user accounts, permissions, groups, and the entire authentication and authorisation framework tested on the 220-1202 exam.

## Core explanation

User authentication and access control is the security system that decides who is allowed to enter a computer system and what they are allowed to do once they are inside. Think of it as a two-step process. First, the system must verify your identity. This is authentication. Second, the system must check what you are allowed to do. This is authorisation. These two concepts are different, but they work together constantly.

Let us start with authentication. Authentication is the process of proving you are who you say you are. The most common way is with a username and password. Your username is your claimed identity, and the password is the secret that proves it. In the real world, this is like showing your ID card at the door of an office. The ID card says you are Sarah, but the security guard needs to check that the photo matches your face. On a computer, the password is the digital version of that photo match. But passwords have a problem. They can be guessed, stolen, or forgotten. That is why modern systems use more than one method.

CompTIA A+ Core 2 tests several types of authentication factors. A factor is a category of evidence. The three main categories are something you know, something you have, and something you are. Something you know is a password or a PIN. Something you have is a physical object like a smart card, a key fob, or a one-time code sent to your phone. Something you are is a biometric trait like a fingerprint, a face scan, or a retina scan. When a system uses two different factors, it is called multi-factor authentication (MFA). For example, logging into a website with a password (something you know) and then entering a code from your phone (something you have) is MFA. Using two passwords is not MFA because both are the same factor (something you know).

Once the system has authenticated you, authorisation begins. Authorisation determines what resources you can access and what actions you can perform. This is controlled by permissions and rights. Permissions are rules that grant access to specific resources like files, folders, or printers. Rights are privileges that allow you to perform system-level actions, such as installing software or changing system settings. For example, a standard user might have permission to read a shared folder but not to delete it. An administrator has the right to install new applications on the entire system.

Access control models are the frameworks that manage these permissions. The exam focuses on several models:

- Discretionary Access Control (DAC): The owner of a resource decides who can access it. On a Windows computer, if you create a file, you are the owner and you can share it with specific people by setting permissions.
- Mandatory Access Control (MAC): A central authority sets access rules that users cannot override. This is common in high-security government systems. Each user and each resource is given a security label, like “Top Secret” or “Unclassified.” A user can only access resources with a label equal to or below their own clearance.
- Role-Based Access Control (RBAC): Permissions are assigned to roles, and users are assigned to those roles. For example, in a company, the “Sales” role might have access to the customer database and the “HR” role has access to employee records. If a new salesperson starts, you simply add them to the “Sales” role. You do not set individual permissions for that person. RBAC is the most common model in business environments and is heavily tested on 220-1202.

The operating system keeps track of all this using security principals and security identifiers (SIDs). A security principal is any entity that can be authenticated, such as a user account, a group, or a computer. Each one gets a unique SID. When a user logs in, the system creates an access token. This token contains the user’s SID and the SIDs of all groups they belong to. Every time the user tries to access a resource, the system compares the SIDs in the token to the access control list (ACL) on that resource. The ACL is a list of rules that say which SIDs are allowed or denied access. If the token contains a SID that is in the “Deny” list, access is blocked. If it contains a SID in the “Allow” list, access is granted.

Group accounts are a huge part of managing access control efficiently. Instead of setting permissions for 100 individual users, you create a group called “Marketing Team” and set permissions once for the group. Then you add the 100 users to that group. If a user leaves the marketing team, you remove them from the group. This simplifies administration and reduces errors. The exam tests knowledge of built-in groups on Windows, such as Administrators, Users, Guests, and Power Users. It also tests the concept of local users versus domain users. A local user account exists only on one machine, whereas a domain user account is stored centrally on a server and can log in to any computer on the network.

Finally, the principle of least privilege is the golden rule of access control. It states that a user should be given the minimum level of access required to perform their job. Do not give a receptionist administrative rights just because it is easier. If their account is compromised, the attacker will have full control of the system. Always grant the least amount of privilege necessary, and audit accounts regularly to ensure no one has excessive permissions.

## Real-world context

You are a junior IT support technician at a medium-sized marketing agency called AdVantage with 200 employees. You are responsible for onboarding new hires and managing user accounts. Today, a new graphic designer named Priya starts. Here is what you actually do.

First, you receive a ticket from HR with Priya’s start date and job title. You open the Active Directory Users and Computers console on your administrative workstation. Active Directory is the directory service that manages all users and computers on the company network. You locate the “Users” organisational unit (OU) and create a new user object. You fill in her first name, last name, user logon name, and a temporary password. You check the box that forces a password change at next logon. This is a security requirement. You do not want anyone else to know her initial password.

Next, you need to authorise access to the resources she needs. Priya is a graphic designer, so she needs access to the design file server, the colour printer, and the Adobe Creative Cloud licence. You do not set permissions for her individually because that would be a waste of time. Instead, you add her user account to the existing security group called “Designers.” This group already has permissions set to read and write to the “DesignProjects” shared folder. It also has the right to use the colour printer. You also add her to the “Licensed_Adobe_Users” group, which allows her account to authenticate to the Adobe licensing server. You do not add her to the “Administrators” group because that would give her full control of a computer, which she does not need.

Now you walk through the principle of least privilege. Priya does not need access to the HR payroll folder or the client billing system. By adding her only to the “Designers” and “Licensed_Adobe_Users” groups, you have granted the minimum access she needs. If she later needs access to a project management tool, you will add her to that specific group only after receiving approval from her manager.

You also configure a couple of other security settings. You set the account to expire automatically in one year. This is a good practice for temporary or contract workers. You also enable the option that requires Priya to use multi-factor authentication (MFA) for remote access. The company uses Microsoft Entra ID for cloud services, so you ensure that her account is registered for MFA. When she logs in from home, she will need to enter a code from an authenticator app on her phone.

Later that week, Priya reports that she cannot open a particular design template. You check the permissions on that file. The access control list (ACL) shows that the “Everyone” group has read access, but the “Designers” group has only read access as well. The template needs write access for designers to edit it. You modify the ACL and grant the “Designers” group “Modify” permission. This change affects every member of the group immediately. You did not have to change Priya’s account at all.

Finally, you document everything. You update the user account creation checklist. You note the groups she was added to, the date the account was created, and the ticket number. This documentation is essential for audits and for future troubleshooting. If an auditor asks why Priya has access to the design server, you can point to the documentation and the group membership. This scenario covers user provisioning, group-based access control, least privilege, MFA, and managing permissions—all core tasks for an IT support professional.

## Exam focus

The 220-1202 exam tests authentication and access control heavily. Expect around 8–12 questions on this domain. The exam loves to present you with a scenario and ask which type of access control model is in use, or what concept is being described. You must be able to distinguish between authentication, authorisation, and accounting. You must also know the different authentication factors and be able to pick the best MFA solution for a given situation.

Here are the exact concepts they love to test:

- The difference between Authentication and Authorisation: A common trap question describes a user logging in (authentication) and then being denied access to a file (authorisation). The question will ask “What is this an example of?” with options like “Authentication failure” or “Authorisation failure.” The correct answer is authorisation failure because the user proved their identity but did not have the right permissions.
- Multi-factor authentication (MFA) requirements: They will ask which combination of factors qualifies as MFA. Remember, two factors from the same category do not count. A password and a PIN are both “something you know.” That is not MFA. A password and a fingerprint are MFA. A smart card (something you have) with a PIN (something you know) is MFA.
- Access control models (DAC, MAC, RBAC): They will give you a description of how permissions are assigned and ask you to name the model. If the owner decides, it is DAC. If a central authority decides with labels, it is MAC. If permissions are tied to a job role, it is RBAC. RBAC is the most common answer for business environments.
- Group-based permissions vs. individual permissions: They might ask you to identify the most efficient way to grant a set of new employees access to the same resources. The correct answer is to create a security group, assign the permissions to the group, and then add the users to the group. Adding users directly is inefficient and error-prone.
- Built-in groups and their privileges: Know the difference between the “Administrators” group, “Users” group, and “Power Users” group (which is deprecated but still appears in some questions). Also know that the “Guests” group has very limited access.
- The principle of least privilege: Questions will describe a situation where a user has more access than needed and ask what security principle is being violated. The answer is the principle of least privilege.
- Types of authentication: Know the difference between local authentication (against the local SAM database on a Windows machine) and domain authentication (against Active Directory). Also know about Microsoft Entra ID for cloud authentication.
- Password policies: They test concepts like password complexity, password history, minimum password length, and account lockout policies. They might ask you to configure these in a scenario.

Trap patterns to watch for:
- They will offer “something you know” paired with “something you know” and label it as MFA. It is not. Reject it.
- They will describe Mandatory Access Control but use the word “discretionary” in the description. Read carefully.
- They will use the word “rights” when you would normally expect “permissions.” Example: “The right to change the system time” is a right, not a permission. Know the difference.

Key definitions to memorise:
- Authentication: Proving identity.
- Authorisation: Granting or denying access to resources.
- ACL: Access Control List – a list of permissions attached to a resource.
- SID: Security Identifier – a unique identifier for each user, group, or computer.
- Token: A temporary credential containing the user’s SID and group SIDs, used for authorisation checks.
- SSO: Single Sign-On – a system that lets a user authenticate once and access multiple systems without re-entering credentials.

## Step by step

1. **User Account Creation** — An administrator creates a new user account in the operating system or directory service. This involves assigning a unique username and an initial password (often with a forced change on next logon). This step establishes the identity that will be authenticated in future logins.
2. **Password Policy Enforcement** — The system applies password policies such as minimum length, complexity requirements, and password history. These policies are set by the administrator to ensure that user-chosen passwords meet security standards, making it harder for attackers to guess or crack them.
3. **Group Assignment** — The administrator adds the new user account to one or more security groups. For example, a salesperson might be added to the 'Sales' group. This step is critical for efficient permissions management because permissions are already assigned to the groups, not to individual users.
4. **Permission Configuration via ACLs** — Permission sets are applied to resources (files, folders, printers) through their Access Control Lists. The ACL contains entries that grant or deny specific rights (read, write, modify) to users or groups. The system refers to these ACLs every time a user tries to access a resource.
5. **Authentication During Login** — When the user logs in, the system validates their credentials (username and password or other factors). If successful, the system creates an access token containing the user's SID and all group SIDs. This token is used for all subsequent authorisation checks during that session.
6. **Authorisation Check on Resource Access** — Every time the user attempts to open a file, print a document, or run an application, the operating system compares the SIDs in the user's access token against the ACL on the target resource. If a matching allow entry exists and no deny entry blocks it, access is granted. Otherwise, access is denied.
7. **Periodic Audit and Account Maintenance** — Administrators regularly review user accounts and permissions to ensure the principle of least privilege is maintained. Stale accounts (e.g., former employees) are disabled or deleted. Users who changed roles are moved to the appropriate groups and removed from groups they no longer need.

## Comparisons

### Authentication vs Authorisation

**Authentication:**
- Verifies a user's identity (e.g., password, fingerprint).
- Happens first during the login process.
- Answers the question: 'Who are you?'

**Authorisation:**
- Determines what a user is allowed to access or do.
- Happens after authentication, when the user requests a resource.
- Answers the question: 'What are you allowed to do?'

### Something You Know vs Something You Have

**Something You Know:**
- A piece of information like a password, PIN, or answer to a security question.
- Can be forgotten or guessed by an attacker.
- Alone, it is considered the weakest authentication factor.

**Something You Have:**
- A physical object like a smart card, key fob, or a phone receiving a one-time code.
- Can be lost or stolen, but usually requires another factor to use effectively.
- Provides stronger security when combined with something you know.

### DAC (Discretionary Access Control) vs RBAC (Role-Based Access Control)

**DAC (Discretionary Access Control):**
- The owner of a resource decides who can access it.
- Permissions are set on a per-user or per-group basis directly by the resource owner.
- Can become unmanageable in large environments with many resources.

**RBAC (Role-Based Access Control):**
- Permissions are assigned to roles, not directly to users.
- Users are assigned to roles, and they inherit the role's permissions.
- Easier to manage and audit in large organisations because changes are made at the role level.

### Local User Account vs Domain User Account

**Local User Account:**
- Stored in the local Security Accounts Manager (SAM) database on one machine.
- Can only log in to the specific computer where the account was created.
- Managed individually on each machine, which is inefficient for multiple computers.

**Domain User Account:**
- Stored in a central directory like Active Directory.
- Can log in to any computer that is part of the domain.
- Managed centrally, allowing an administrator to update policies and permissions from one place.

## Diagram

_This diagram shows the flow from user login through authentication, token creation, and authorisation against the resource's ACL._

```mermaid
flowchart TD
    A[User] -->|Enters Credentials| B[Authentication System]
    B -->|Validates Password| C{Authenticated?}
    C -->|No| D[Access Denied]
    C -->|Yes| E[Creates Access Token]
    E -->|Contains User SID + Group SIDs| F{Authorisation Check}
    F -->|Checks ACL on Resource| G[Access Granted or Denied]
    G --> H[User Accesses Resource or Is Blocked]
```

## Common misconceptions

- **Misconception:** Once I log in successfully, I can access everything on the computer. **Reality:** Logging in successfully authenticates you, but you are still restricted by authorisation permissions. You can be logged in and still unable to open files or run programs if those permissions deny you access. (This mistake is common because beginners often equate logging into a computer with having full access. They do not yet understand the separation between authentication and authorisation.)
- **Misconception:** Using two different passwords is multi-factor authentication. **Reality:** Multi-factor authentication requires factors from at least two different categories (knowledge, possession, inherence). Two passwords are both from the same category (something you know), so it is still single-factor authentication. (People hear the word 'multi' and think multiple steps, but they confuse the number of actions with the number of factor categories. The exam deliberately tests this distinction.)
- **Misconception:** If a user is a member of the Administrators group, they automatically inherit all rights and cannot be denied anything. **Reality:** Administrators have extensive rights, but explicit deny permissions on a resource will still block them. Deny rules always override allow rules in Windows access control, even for administrators. (Users assume administrators are like gods on the system, but security design includes explicit deny entries for a reason – to prevent even privileged accounts from accessing highly sensitive data when needed.)
- **Misconception:** A user account and a user profile are the same thing. **Reality:** A user account is the security identity used for authentication and authorisation. A user profile is the collection of settings, files, and preferences associated with that account on a specific computer. Deleting the profile does not delete the account, and vice versa. (The terms sound similar, and beginners often use them interchangeably. On the exam, they might describe deleting a profile and ask what happened to the account, tempting you to think the account was also deleted.)
- **Misconception:** Requiring a password change every 30 days is always the most secure policy. **Reality:** Frequent password changes can actually lead to weaker security because users choose simpler passwords or write them down. Modern guidance from NIST recommends longer, less frequent password changes unless there is evidence of compromise. (Older security policies pushed mandatory periodic changes, and many IT professionals still believe this is best practice. The 220-1202 exam aligns with current NIST recommendations, which favour longer, complex passwords changed only upon compromise suspicion.)

## Key takeaways

- Authentication proves who you are, authorisation determines what you can do after you are authenticated.
- Multi-factor authentication requires at least two different authentication factors from the categories of something you know, something you have, or something you are.
- Role-Based Access Control (RBAC) assigns permissions to roles, and users inherit permissions through their role membership.
- The principle of least privilege states that users should have only the minimum permissions necessary to perform their job tasks.
- An Access Control List (ACL) is a list of permissions attached to a resource that dictates which users and groups can access it and what actions they can perform.
- Security groups simplify permission management by allowing you to assign permissions once to the group and then add or remove users from that group.
- A local user account is stored on a single machine, while a domain user account is stored in a central directory like Active Directory and can be used across multiple computers on the network.
- Explicit deny permissions overrule allow permissions in Windows access control, even for members of the Administrators group.

## FAQ

**What is the difference between authentication and authorisation?**

Authentication is the process of verifying a user's identity (e.g., logging in with a password). Authorisation is the process of determining what that authenticated user is allowed to access or do (e.g., read a specific file). You must be authenticated first, but authentication does not guarantee authorisation.

**Is a password plus a PIN considered multi-factor authentication?**

No. Both a password and a PIN are in the 'something you know' category. Multi-factor authentication requires at least two different categories, such as a password (something you know) and a fingerprint (something you are).

**What is a security group in Windows?**

A security group is a collection of user accounts that simplifies permission management. Instead of assigning permissions to each user individually, you assign permissions to the group and then add users to the group. All members inherit the group's permissions.

**What does the principle of least privilege mean in practice?**

It means giving a user only the exact permissions they need to do their job, and nothing more. For example, a receptionist should not have administrative access to the server. This reduces the risk of accidental or malicious damage if the account is compromised.

**What is an Access Control List (ACL)?**

An Access Control List is a list of rules attached to a resource (like a file or printer). Each rule specifies which user or group is allowed or denied a specific action (like 'read' or 'modify'). The operating system checks the ACL whenever a user tries to access the resource.

**What is a user token and why is it important?**

A user token is a data object created by the operating system when a user logs in. It contains the user's security identifier (SID) and the SIDs of all groups they belong to. The system uses this token for every subsequent authorisation check, making it central to how access control works in Windows.

**What is the difference between a local user and a domain user?**

A local user account is stored on a single computer and can only log in to that computer. A domain user account is stored in a central directory service like Active Directory and can log in to any computer that is part of the domain, allowing centralised management.

## Check your understanding

1. **What is the term for the process of determining whether an authenticated user has the right to access a specific file?**

   Answer: Authorisation.

2. **Which type of access control model assigns permissions to job roles and then adds users to those roles?**

   Answer: Role-Based Access Control (RBAC).

3. **An employee logs in with a password and then receives a one-time code on their phone. What type of security practice is this?**

   Answer: Multi-factor authentication (MFA), because it uses two different factors: something you know (password) and something you have (phone).

4. **What security principle states that a user should only be given the minimum permissions needed to perform their job?**

   Answer: The principle of least privilege.

5. **When a user logs in, the operating system creates a data object containing the user's SID and group SIDs. What is this object called?**

   Answer: An access token.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/a-plus-220-1202/user-authentication-and-access-control