Welcome to the [Computing + Mathematical Sciences Department](https://cms.caltech.edu).

The following information will help you get the most out of your account here in CMS, whether you use UNIX or Windows.

When in doubt, you can find answers to most of your questions on this wiki, or in the [FAQ](/Main/FAQ).

If you have not read the [acceptable use policy](https://www.imss.caltech.edu/services/security/policies) for the IMSS cluster, you should do so.

If you have a newly created CMS account, the account's temporary password is expired.

You have a grace period of 7 days to log in and change your password. If you do not log in within 7 days (or you forget your temporary password, or you change your password and forget your new password) your account will be locked, and you will need to see the CMS Systems Administrators in person to get your account unlocked.

Our office(s) are on the first floor of Annenberg, you should call ahead to make sure that we're in the office:

* Pat Cahalan - 112 Annenberg, on campus extension 3290

For instructions on changing your password, see the [FAQ How do I change my password?](/Main//FAQ#how-do-i-change-my-password)

For the CMS account policy, including password expiration events and account culling, see the [FAQ What is the account policy?](/Main/FAQ#what-is-cmss-account-policy).

The CMS active directory domain is cs-ad.cs.caltech.edu (referred to hereafter under the old style WINS name CS-AD). If you have a CS-AD account, you can log into any of the public machines in Annenberg using your CS-AD account, including the machines in the 104 lab, and any of the research group lab machines you may have access to.

Unless specifically requested and authorized by an approved faculty member, your account does not have local administrator privileges on any machines in the domain. If you require elevated privileges to run some specific code (note - this is unlikely), contact helpATcs.caltech.edu.

If you have your own personal computer and it is not a part of the domain, you can access CS-AD resources using your credentials (more on this later), but you are expected to conform to the best practices for Windows as outlined later in this document.

The first time you log into a machine using your domain account, a roaming profile will be created for you. This windows-specific profile is stored on the filer here in CS, as a subdirectory of your UNIX home directory, and is automatically synchronized to your local machine when you log into/out of the domain. All information that is stored in this profile is backed up on the server side on an hourly/daily/weekly schedule. Note - changes to your profile are only replicated to the server when you LOG OFF of the machine. Therefore, changes are also only backed up when you log off of the machine. Make sure you log off every night!

A. The profile includes all of the subfolders of c:\Documents and Settings\, except the hidden folder "Local Settings".

This includes everything you store in your My Documents folder, your Internet Explorer Favorites and Cookies, your History folder, your Start Menu settings, and your Desktop settings and files.

It does NOT include the data files for Microsoft Outlook and/or Outlook Express (which are stored in the "Local Settings" folder) or data files for any Windows program that does not by default store data in "My Documents". This includes, but is not limited to, Eudora local folders, Netscape local folders (mail), cookies and bookmarks (browser), Mozilla, most Adobe products, most freeware/shareware products, and other non-Microsoft applications.

If you are using a non-Microsoft application, make sure you save your data files to "My Documents", instead of the program directory for the application. Domain Policies

In addition, any Windows machine that connects to CS resources is expected to adhere to the following standards:

* should have installed all of the latest security patches and updates from the windows update site

* should have automatic updates configured to download and install the latest updates daily.

* should have installed all of the latest security patches from the office update site, if running Microsoft Office

* should have installed and running the latest updated version of Norton Anti-Virus (\forge.cs.caltech.edu\software_repository\Norton_Corp)

* should have a non-trivial local Administrator account

* if not a member of the domain, should have domain-style minimum password requirements, namely:

* 8 characters minimum

* not contain multiple repeat characters

* not be based on a dictionary (english or otherwise) word

* mix of three of the four following types of charaters:

* uppercase letters

* lowercase letters

* numbers

* special characters (%, $, {, ?, etc)

* password life of no more than 6 months

* should have no local file shares set up

* should have the audit log enabled

Given the wild spread of computer viruses targeting Microsoft Windows systems, and the lack of network-based security on the Caltech campus, failure to follow the above basic policies leaves your machine open to several forms of attack, any of which can affect other users not only in the Caltech domain, but all across campus.