Solved

Local Security Groups issue?

Posted on 2004-09-29
7
144 Views
Last Modified: 2010-04-14
Should you avoid adding domain user accounts to local groups?  What are some examples of this that can't be avoided?  
0
Comment
Question by:mystikal1000
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
7 Comments
 
LVL 6

Expert Comment

by:tanelorn
ID: 12182402
yes,  you should avoid it.  it can become an administratie nightmare.

but.

we usually add the user of the workstation to the administrator's group on the machine.
that too can be avoided.  but we controll the important things with policy...


Tanelorn

0
 
LVL 7

Expert Comment

by:katacombz
ID: 12182707
I ahd a group tht argued for local admin rights, so after awuile i gave it to them.

then went back and disabled windows installer the run command among other items i do not want them playing with through group policy....;-}


0
 
LVL 6

Expert Comment

by:tanelorn
ID: 12182744
I don't see any reason not to give the users local admin rights as long as they are responsible for that machine.  like it has to be on thier desk....

if they hose it up too badly,  a reimage is only  pxe-boot and a batfile away...


T
0
Best Practices: Disaster Recovery Testing

Besides backup, any IT division should have a disaster recovery plan. You will find a few tips below relating to the development of such a plan and to what issues one should pay special attention in the course of backup planning.

 
LVL 1

Author Comment

by:mystikal1000
ID: 12182793
What about for servers?
0
 
LVL 6

Expert Comment

by:tanelorn
ID: 12182912
for servers,  I always use groups.

wether its file permissions or rights (to backup/restore for example)

always

people come and go .  job functions do not.  


T
0
 
LVL 11

Assisted Solution

by:cfairley
cfairley earned 250 total points
ID: 12183197
In reference to servers, I sometimes create local or domain local groups after the permission I want to give and assign that specific permission to the local group.  For example,  "SalesfolderR" = Read permission, "SalesFolderC" =  Change, "SalesFolderFC" = Full Control.  Then I would put the "SalesManagers" global group into the "SalesFolderFC" local group and "SalesUsers" global group into the SalesFolderR or C.  Microsoft suggests the following AGDLP, Put user Accounts into Global groups, put Global groups into Local or Domain Local groups, and then assign permissions to the local group.  Hope this along with the comments from others help.

The only instance that comes to my mind now as to why you would add a user directly to a local group is if you have a service account like Backup Exec needing access to the local admins group or something.
0
 
LVL 7

Accepted Solution

by:
katacombz earned 250 total points
ID: 12183515
on servers i will also delagate some group to thier managers for the porpuse of adding new users and  changing passwords. like a sales group that has a high turn over a manager can create a new user in that group. then the manager or help desk can reset the password if a usr is locked out or forgets the password
0

Featured Post

Migrating Your Company's PCs

To keep pace with competitors, businesses must keep employees productive, and that means providing them with the latest technology. This document provides the tips and tricks you need to help you migrate an outdated PC fleet to new desktops, laptops, and tablets.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
An introduction to the wonderful sport of Scam Baiting.  Learn how to help fight scammers by beating them at their own game. This great pass time helps the world, while providing an endless source of entertainment. Enjoy!
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an antispam), the admini…

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question