[Webinar] Streamline your web hosting managementRegister Today

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 151
  • Last Modified:

Local Security Groups issue?

Should you avoid adding domain user accounts to local groups?  What are some examples of this that can't be avoided?  
0
mystikal1000
Asked:
mystikal1000
2 Solutions
 
tanelornCommented:
yes,  you should avoid it.  it can become an administratie nightmare.

but.

we usually add the user of the workstation to the administrator's group on the machine.
that too can be avoided.  but we controll the important things with policy...


Tanelorn

0
 
katacombzCommented:
I ahd a group tht argued for local admin rights, so after awuile i gave it to them.

then went back and disabled windows installer the run command among other items i do not want them playing with through group policy....;-}


0
 
tanelornCommented:
I don't see any reason not to give the users local admin rights as long as they are responsible for that machine.  like it has to be on thier desk....

if they hose it up too badly,  a reimage is only  pxe-boot and a batfile away...


T
0
Hire Technology Freelancers with Gigs

Work with freelancers specializing in everything from database administration to programming, who have proven themselves as experts in their field. Hire the best, collaborate easily, pay securely, and get projects done right.

 
mystikal1000Author Commented:
What about for servers?
0
 
tanelornCommented:
for servers,  I always use groups.

wether its file permissions or rights (to backup/restore for example)

always

people come and go .  job functions do not.  


T
0
 
cfairleyCommented:
In reference to servers, I sometimes create local or domain local groups after the permission I want to give and assign that specific permission to the local group.  For example,  "SalesfolderR" = Read permission, "SalesFolderC" =  Change, "SalesFolderFC" = Full Control.  Then I would put the "SalesManagers" global group into the "SalesFolderFC" local group and "SalesUsers" global group into the SalesFolderR or C.  Microsoft suggests the following AGDLP, Put user Accounts into Global groups, put Global groups into Local or Domain Local groups, and then assign permissions to the local group.  Hope this along with the comments from others help.

The only instance that comes to my mind now as to why you would add a user directly to a local group is if you have a service account like Backup Exec needing access to the local admins group or something.
0
 
katacombzCommented:
on servers i will also delagate some group to thier managers for the porpuse of adding new users and  changing passwords. like a sales group that has a high turn over a manager can create a new user in that group. then the manager or help desk can reset the password if a usr is locked out or forgets the password
0

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now