M12 - Who Owns What: Users and Groups
Who Owns What: Users and Groups
Understand how users, groups, and administrator-level accounts divide access so one machine can be used safely by different people and processes.
- Explain what a user account represents.
- Explain why groups exist.
- Distinguish between a normal account and an administrator or root account.
Why This Matters
Permissions start with identity.
Before an operating system can decide whether a file may be opened or a setting may be changed, it has to answer a simpler question first: who is asking?
That is why systems use:
- user accounts for individual identities
- groups for shared roles
- administrator or root-level accounts for high-risk system changes
1. A User Account Is an Identity
A user account tells the system who is signed in and what that identity is normally allowed to do.
A user account usually has:
- a username
- a home area or profile
- settings tied to that identity
- permissions that may differ from other accounts on the same machine
This matters on both personal laptops and shared servers.
2. A Group Is a Shared Role
Groups exist so you do not have to manage every permission one user at a time.
Examples:
- everyone in the
developersgroup can access a shared code folder - everyone in the
administratorsgroup can perform elevated tasks - a service account belongs to a group that grants access only to what that service needs
If ten people need the same access, a group is usually cleaner than ten separate permission edits.
3. Normal Accounts Versus Powerful Accounts
Most daily work should happen in a normal account.
That protects the system from mistakes and limits the damage if a bad command or unsafe program runs.
Core Safety Idea
The most powerful account should be used rarely and deliberately. Convenience is not a good enough reason to stay elevated all day.
Windows uses the idea of standard users and administrator-capable users. Even when you belong to the Administrators group, Windows still asks for elevation through UAC before certain actions proceed.
Linux separates normal users from the root account. Root can override most permission barriers, which is why systems encourage temporary elevation instead of living in a root shell.
4. Not Every Account Is a Human
Operating systems also create service or system accounts.
These accounts exist so applications and background services can run with limited, specific permissions instead of full administrative power.
That is a sign of a healthier system design: each process gets only what it needs.
What to Ignore for Now
- the full internal storage format of account databases
- advanced directory services such as Active Directory or LDAP
- low-level security identifiers and token internals
The goal here is to understand the access model before touching management commands.
Before You Move On
You are ready for the next lesson when you can explain:
- what a user account represents
- why groups exist
- why administrator or root access should be used sparingly
Next, we look at how these ideas appear in graphical account-management tools.