Assigning user rights:

burdon

Hey,

I hope some one can help me with a few suggestions about what rights i should assign to my network through Active Directory. I was hoping that there might be a "standard" or "template" i could follow. (forgive my terminology)


Any ideas
I'm Stuck

Thanks
Burdon

PS: i am an IT JNR so i am still learning :P

woolymammoth

that depends entirely on the situation, how many users do you have, how many shared resources, who needs access to what.

If you've many users, and they all need to access certain folders, then it's best to create one or more groups for each folder, with varying permissions as needed, then just add people to those groups.

there's more to it, but in simple terms, that's it.

Capt'n Midnight

you could change everyone to "authenticated users"

for each shared folder create a group of the same name
members of that group get read-write access,

general rules
that which is not expressly permitted is denied - ie. if someone doesn' have a reason to see something they shouldn't see it.
if they don't need to edit files then the folder should be read only

lots of gotchas - my pet hate is the way permissions are inherited from higher folders


oops just saw you said AD not folders
user permissions or pc permissions ?
there is no reason for end users to have admin permissions - is a good starting point

normally it would be used for settings rather than rights but depends on your specific needs

burdon

the network is about 30 people at the moment but it is growing fast enough.

I know the question i asked was a very broad question. But thanks for your input lads.

Will get stuck into a few online articles about AD and see what happens.

DannyBuoy

One little tip is to create a group for IT Support use and add yourself and whoever else needs to be added. Then when building new pcs or laptops add this group to the local admin group, this means you have admin rights to each pc on the network or when you log in to it, very useful when looking after a bunch of machines.