Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Local Security Groups issue?

Posted on 2004-09-29
7
Medium Priority
?
148 Views
Last Modified: 2010-04-14
Should you avoid adding domain user accounts to local groups?  What are some examples of this that can't be avoided?  
0
Comment
Question by:mystikal1000
7 Comments
 
LVL 6

Expert Comment

by:tanelorn
ID: 12182402
yes,  you should avoid it.  it can become an administratie nightmare.

but.

we usually add the user of the workstation to the administrator's group on the machine.
that too can be avoided.  but we controll the important things with policy...


Tanelorn

0
 
LVL 7

Expert Comment

by:katacombz
ID: 12182707
I ahd a group tht argued for local admin rights, so after awuile i gave it to them.

then went back and disabled windows installer the run command among other items i do not want them playing with through group policy....;-}


0
 
LVL 6

Expert Comment

by:tanelorn
ID: 12182744
I don't see any reason not to give the users local admin rights as long as they are responsible for that machine.  like it has to be on thier desk....

if they hose it up too badly,  a reimage is only  pxe-boot and a batfile away...


T
0
Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

 
LVL 1

Author Comment

by:mystikal1000
ID: 12182793
What about for servers?
0
 
LVL 6

Expert Comment

by:tanelorn
ID: 12182912
for servers,  I always use groups.

wether its file permissions or rights (to backup/restore for example)

always

people come and go .  job functions do not.  


T
0
 
LVL 11

Assisted Solution

by:cfairley
cfairley earned 500 total points
ID: 12183197
In reference to servers, I sometimes create local or domain local groups after the permission I want to give and assign that specific permission to the local group.  For example,  "SalesfolderR" = Read permission, "SalesFolderC" =  Change, "SalesFolderFC" = Full Control.  Then I would put the "SalesManagers" global group into the "SalesFolderFC" local group and "SalesUsers" global group into the SalesFolderR or C.  Microsoft suggests the following AGDLP, Put user Accounts into Global groups, put Global groups into Local or Domain Local groups, and then assign permissions to the local group.  Hope this along with the comments from others help.

The only instance that comes to my mind now as to why you would add a user directly to a local group is if you have a service account like Backup Exec needing access to the local admins group or something.
0
 
LVL 7

Accepted Solution

by:
katacombz earned 500 total points
ID: 12183515
on servers i will also delagate some group to thier managers for the porpuse of adding new users and  changing passwords. like a sales group that has a high turn over a manager can create a new user in that group. then the manager or help desk can reset the password if a usr is locked out or forgets the password
0

Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
Following on from our article on "The Murky World of Consent and opt in", we thought we would issue some helpful guidance, not only on consent itself but knowing what information you are capturing, what you are doing with this data and how you can p…
Please read the paragraph below before following the instructions in the video — there are important caveats in the paragraph that I did not mention in the video. If your PaperPort 12 or PaperPort 14 is failing to start, or crashing, or hanging, …
When cloud platforms entered the scene, users and companies jumped on board to take advantage of the many benefits, like the ability to work and connect with company information from various locations. What many didn't foresee was the increased risk…
Suggested Courses

927 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question