Switching Users in the Current Logon Session

Do Windows Server 2003 and Windows 2000 support a utility similar to the switch-user (su) utility for UNIX that lets you create a new logon session within an existing one? If such a feature is available in Windows, what are its benefits and limitations?

Yes, Windows 2003 and Win2K offer a similar feature known as the Secondary Logon Service. SLS lets users enter an additional set of credentials to start another logon session within their current logon session. Before Win2K, Microsoft offered a special utility as part of the Windows NT Server 4.0 Resource Kit called su.exe (yes, the company borrowed the name from the UNIX su utility) to provide this functionality. Today, Windows 2003 and Win2K install the SLS service by default and automatically start the service when the system boots.

Using a secondary logon is a security best practice. Many security incidents happen because administrators remain logged on with their high-privilege account credentials. They use these logon credentials to perform both administrative tasks and nonadministrative tasks such as reading their email, or worse, surfing the Internet. . . .