Why It Is Important To Understand Impersonation

By Author: MCSA Certification,Windows XP Professional,free Mi
Total Articles: 127
Comment this article

Impersonation, a concept that indicates a process can run under MCSA Certification（http://www.mcsa-70-270.com）
different security credentials, is basic to all Windows operating systems. Impersonation becomes especially interesting when applied to application pools. Although a worker process runs in its application pool under the application pool identity, it also is allowed to impersonate its own or run under security credentials different from its own—base identity. When a worker process is created, it is given a process token associated with the application pool identity, and by default, everything the worker process does is done using this context. It can do only what it has been given the rights and permissions to do. However, if a user request is processed (that is, if a user accesses the Web site in the application pool), the thread (which can be one of many a process utilizes) that services the request is given a token associated with the user: the authenticated user's token. For each action (such as reading a Web page or executing a script) that the user attempts, her token is validated against ...
... the ACL of the resource. This concept is extended as well if the request involves the use of an ISAPI extension. Hence, NTFS permissions Windows XP Professional(http://www.mcsa-70-270.com)
must be set to allow or restrict users and the application pool identity.
If this concept is misunderstood, it can result in a compatibility problem. For example, it can result in Web applications that will not run, except for running anonymously or when using the administrator account. Unfortunately, this could result in an unsophisticated IT administrator, in an attempt to solve the compatibility problem, giving users who must run the application membership in the local administrators group on the Web server. To prevent this situation, application designers, Web site administrators, as well as domain administrators should be educated on the application identity concept and the correct configuration for any Web applications should be well documented. In addition, applications should be tested using accounts other than that of an administrator to ensure that once deployed, they will work correctly for all authorized users.
You should note that IP addresses can be easily spoofed. If this is done, these controls will not prevent unauthorized use. These controls should still be use free Microsoft practice questions(http://www.examshots.com/vendor/Microsoft-1.html)
, however, because they will prevent much abuse.