Solved

Local Security Groups issue?

Posted on 2004-09-29
7
143 Views
Last Modified: 2010-04-14
Should you avoid adding domain user accounts to local groups?  What are some examples of this that can't be avoided?  
0
Comment
Question by:mystikal1000
7 Comments
 
LVL 6

Expert Comment

by:tanelorn
ID: 12182402
yes,  you should avoid it.  it can become an administratie nightmare.

but.

we usually add the user of the workstation to the administrator's group on the machine.
that too can be avoided.  but we controll the important things with policy...


Tanelorn

0
 
LVL 7

Expert Comment

by:katacombz
ID: 12182707
I ahd a group tht argued for local admin rights, so after awuile i gave it to them.

then went back and disabled windows installer the run command among other items i do not want them playing with through group policy....;-}


0
 
LVL 6

Expert Comment

by:tanelorn
ID: 12182744
I don't see any reason not to give the users local admin rights as long as they are responsible for that machine.  like it has to be on thier desk....

if they hose it up too badly,  a reimage is only  pxe-boot and a batfile away...


T
0
Edgartown IT Case Study

Learn about Edgartown's quest to ensure the safety and security of the entire town's employee and citizen data. Read the case study!

 
LVL 1

Author Comment

by:mystikal1000
ID: 12182793
What about for servers?
0
 
LVL 6

Expert Comment

by:tanelorn
ID: 12182912
for servers,  I always use groups.

wether its file permissions or rights (to backup/restore for example)

always

people come and go .  job functions do not.  


T
0
 
LVL 11

Assisted Solution

by:cfairley
cfairley earned 250 total points
ID: 12183197
In reference to servers, I sometimes create local or domain local groups after the permission I want to give and assign that specific permission to the local group.  For example,  "SalesfolderR" = Read permission, "SalesFolderC" =  Change, "SalesFolderFC" = Full Control.  Then I would put the "SalesManagers" global group into the "SalesFolderFC" local group and "SalesUsers" global group into the SalesFolderR or C.  Microsoft suggests the following AGDLP, Put user Accounts into Global groups, put Global groups into Local or Domain Local groups, and then assign permissions to the local group.  Hope this along with the comments from others help.

The only instance that comes to my mind now as to why you would add a user directly to a local group is if you have a service account like Backup Exec needing access to the local admins group or something.
0
 
LVL 7

Accepted Solution

by:
katacombz earned 250 total points
ID: 12183515
on servers i will also delagate some group to thier managers for the porpuse of adding new users and  changing passwords. like a sales group that has a high turn over a manager can create a new user in that group. then the manager or help desk can reset the password if a usr is locked out or forgets the password
0

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
Always backup Domain, SYSVOL etc.using processes according to Microsoft Best Practices. This is meant as a disaster recovery process for small environments that did not implement backup processes and did not run a secondary domain controller that ne…

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question