I'm looking for any best practices I can find on setting up the best SBS installation for corporate clients.
One of the things I'm interested in are groups. I have an understanding of how NTFS permissions work but what I'd like to do is restrict users on a company-level basis (e.g. Managers, Staff, Employees etc). So for example Managers will be able to install applications, manage printers and users etc. Staff and Employees would then have their own special group permissions.
However (unsure if this is a best practice) I want to prevent anyone but the IT Staff from gaining access to the server on a domain-level scale. Of course the Managers will need access to the server to add/edit/remove users, printers, shares and so on, but I don't want them to have access to the entire domain itself.
Can anyone advise on what the best steps would be to take?
Thanks in advance,