Solved

Local Security Groups issue?

Posted on 2004-09-29
7
142 Views
Last Modified: 2010-04-14
Should you avoid adding domain user accounts to local groups?  What are some examples of this that can't be avoided?  
0
Comment
Question by:mystikal1000
7 Comments
 
LVL 6

Expert Comment

by:tanelorn
ID: 12182402
yes,  you should avoid it.  it can become an administratie nightmare.

but.

we usually add the user of the workstation to the administrator's group on the machine.
that too can be avoided.  but we controll the important things with policy...


Tanelorn

0
 
LVL 7

Expert Comment

by:katacombz
ID: 12182707
I ahd a group tht argued for local admin rights, so after awuile i gave it to them.

then went back and disabled windows installer the run command among other items i do not want them playing with through group policy....;-}


0
 
LVL 6

Expert Comment

by:tanelorn
ID: 12182744
I don't see any reason not to give the users local admin rights as long as they are responsible for that machine.  like it has to be on thier desk....

if they hose it up too badly,  a reimage is only  pxe-boot and a batfile away...


T
0
Migrating Your Company's PCs

To keep pace with competitors, businesses must keep employees productive, and that means providing them with the latest technology. This document provides the tips and tricks you need to help you migrate an outdated PC fleet to new desktops, laptops, and tablets.

 
LVL 1

Author Comment

by:mystikal1000
ID: 12182793
What about for servers?
0
 
LVL 6

Expert Comment

by:tanelorn
ID: 12182912
for servers,  I always use groups.

wether its file permissions or rights (to backup/restore for example)

always

people come and go .  job functions do not.  


T
0
 
LVL 11

Assisted Solution

by:cfairley
cfairley earned 250 total points
ID: 12183197
In reference to servers, I sometimes create local or domain local groups after the permission I want to give and assign that specific permission to the local group.  For example,  "SalesfolderR" = Read permission, "SalesFolderC" =  Change, "SalesFolderFC" = Full Control.  Then I would put the "SalesManagers" global group into the "SalesFolderFC" local group and "SalesUsers" global group into the SalesFolderR or C.  Microsoft suggests the following AGDLP, Put user Accounts into Global groups, put Global groups into Local or Domain Local groups, and then assign permissions to the local group.  Hope this along with the comments from others help.

The only instance that comes to my mind now as to why you would add a user directly to a local group is if you have a service account like Backup Exec needing access to the local admins group or something.
0
 
LVL 7

Accepted Solution

by:
katacombz earned 250 total points
ID: 12183515
on servers i will also delagate some group to thier managers for the porpuse of adding new users and  changing passwords. like a sales group that has a high turn over a manager can create a new user in that group. then the manager or help desk can reset the password if a usr is locked out or forgets the password
0

Featured Post

Free Tool: Postgres Monitoring System

A PHP and Perl based system to collect and display usage statistics from PostgreSQL databases.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Recovering backup .Qic files on Windows 7 6 2,263
kerberos errors 7 552
Windows 2000 undelete (free program?) 6 435
Windows 2000 Sever Lab Setup 1 683
NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
Most MSPs worth their salt are already offering cybersecurity to their customers. But cybersecurity as a service is wide encompassing and can mean many things.  So where are MSPs falling in this spectrum?
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…
Finds all prime numbers in a range requested and places them in a public primes() array. I've demostrated a template size of 30 (2 * 3 * 5) but larger templates can be built such 210  (2 * 3 * 5 * 7) or 2310  (2 * 3 * 5 * 7 * 11). The larger templa…

791 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question