WINDOWS 1002000 PROFESSIONAL RESOURCE KIT [Electronic resources] نسخه متنی

Security Groups, User Rights, and Permissions

Security groups, user rights and permissions provide powerful security management. Management can be high-level, allowing you to manage security for numerous resources, while at the same time it can be fine-grained, allowing specific control of files and folders and user rights.

Security Groups

Windows 2000 allows you to organize users and other objects into groups for easy access permission administration. Defining security groups is a major security task. Security groups can be described according to their scope, such as Global groups or Universal groups, as well as according to their purpose, rights, and role, such as the Everyone group or the Administrators group.

The Windows 2000 security groups let you assign the same security permissions to large numbers of users. This ensures consistent security permissions across all members of a group. Using security groups to assign permissions means the access control on resources remains fairly static and easy to control and audit. Users who need access are added or removed from the appropriate security groups as needed, and the access control lists change infrequently.

How Security Groups Work

Depending on the environment you are working in, you might encounter any of the four main types of security groups:

Domain local groups, which are best used for granting access rights to resources such as file systems or printers that are located on any computer in the domain where common access permissions are required.

Global groups, which are used for combining users who share a common access profile based on job function or business role.

Universal groups, which are used in larger, multi-domain organizations where there is a need to grant access to similar groups of accounts defined in multiple domains. Universal groups are used only in multiple domain trees or forests that have a global catalog.

Computer local groups, which are security groups specific to a computer and not recognized elsewhere in the domain.

For more information about working with the four different types of groups, see the Deployment Planning Guide.

Permissions of Security Groups

Windows 2000 includes a number of preconfigured groups including the following:

Guests: This group allows occasional or one-time users to log on to a workstation's built-in Guest account and be granted limited abilities. Members of the Guest group can also shut down the system. The built-in guest account is disabled by default.

Users: Members of this group (normal authenticated users) do not have broad read/write permission as they did in Windows NT 4.0. These users have read-only permission for most parts of the system and read/write permission in their own profile folders. Users cannot read other users' data, install applications that require modification of system directories, or perform administrative tasks.

Power Users: Members of this group have all the access permissions that Users and Power Users had in Windows NT 4.0. Power Users have read/write permission to other parts of the system in addition to their own profile folders. Power Users can install applications and perform many administrative tasks. If you are running applications that have not been certified for use with Windows 2000, users will need to have Power User privileges.

Backup Operators: Members of this group can back up and restore files on the computer, regardless of any permissions that protect those files. They can also log on to the computer and shut it down, but they cannot change security settings.

Administrators: Members of this group have total control of the desktop, allowing them to complete all tasks. Members of the Administrators group have the same level of rights and permissions they did for Windows NT 4.0. There is also a built-in administrator account that allows administration of the computer. The administrator account is the first account that is created when Windows 2000 is installed.

Security groups are a built-in feature of Windows 2000. No special installation or prerequisite is required.

Implementing Security Groups

To create new users and place them in Security groups, use the Computer Management snap-in of MMC. For more information about creating new users, see Windows 2000 Professional Help.

User Rights

Administrators can assign specific rights to group accounts or to individual user accounts. These rights authorize users to perform specific actions, such as logging on to a system or backing up files and directories. User rights are different from permissions because user rights apply to user accounts, and permissions are attached to objects (such as printers or folders). For information about permissions, see "How Inheritance Affects Permissions" later in this chapter.

User rights can be applied to individual users or to user groups. It is simplest to apply rights to user groups because all users who belong to the group will inherit the rights you grant to the group. It is also possible to apply rights to each user, but this requires more administration because you will have to set rights for each user.

User rights that are assigned to a group are applied to all members of the group while they remain members. If a user is a member of multiple groups, the user's rights are cumulative, which means that the user has more than one set of rights. The only time that rights assigned to one group might conflict with those assigned to another is in the case of certain logon rights. In general, however, user rights assigned to one group do not conflict with the rights assigned to another group. To remove rights from a user, the administrator simply removes the user from the group.

To Assign User Rights to Groups

Open the Group Policy snap-in to MMC.

Double-click the User right you want to assign to a group. Many user rights are in User Rights Assignment.

Click Add, and then enter the group or groups to which you want to grant this permission. Click Check Names to confirm that group names are recognized.

There are two types of user rights:

Privileges: A right which is assigned to a user and specifies allowable actions on the network. An example of a privilege is the right to back up files and directories.

Logon rights: A right which is assigned to a user and specifies the ways in which a user can log on to a system. An example of a logon right is the right to log on to a system locally.

Privileges

Some privileges can override permissions set on an object. For example, a user logged on to a domain account as a member of the Backup Operators group has the right to perform backup operations for all domain servers. However, this requires the ability to read all files on those servers, even files on which their owners have set permissions that explicitly deny access to all users, including members of the Backup Operators group. A user right, in this case, the right to perform a backup, takes precedence over all file and directory permissions.

Table 13.4 shows the privileges that can be assigned to a user by setting user rights. These privileges can be managed with the User Rights policy.

Table 13.4 Privileges That Can Be Assigned to a User

For more information, see "Security Policy" later in this chapter.

Logon Rights

Logon rights can be assigned to a user and managed with the User Rights policy. Logon rights are assigned to users and specify the ways in which a user can log on to a system.

Table 13.5 lists and describes Windows 2000 logon rights.

Table 13.5 Windows 2000 Professional Default Logon Rights

Permissions

You can assign permissions to files or folders and determine what can be done to those resources. Note that you cannot assign rights to files or folders.

For information about how to set file or folder permissions, see Windows 2000 Professional Help.

To Set File or Folder Permissions

Open Windows Explorer, and then locate the file or folder for which you want to set permissions.

Right-click the file or folder, click Properties, and then click the Security tab.

To set up permissions for a new group or user, click Add. Type the name of the group or user you want to set permissions for using the format domainnamename, and then click OK to close the dialog box.

- Or -

To change or remove permissions from an existing group or user, click the name of the group or user.

In Permissions, click Allow or Deny for each permission you want to allow or deny.

- Or -

To remove the group or user from the permissions list, click Remove.

After you set permissions on a folder, new files and subfolders created in the folder inherit these permissions unless you configure this not to happen.

To Prevent A Folder from Imposing Permissions on New Files or Folders

In My Computer, right-click the folder in question, and then click Properties.

On the Security tab, click Advanced.

Select a permission entry from the Permissions Entries list, and then click View/Edit.

Select an alternate inheritance behavior from the Apply onto drop-down list.

To Prevent New Files or Folders from Inheriting Permissions

Using My Computer, right-click the folder in question, and then click Properties.

On the Security tab, clear the Allow inheritable permissions from parent to propagate to this object check box.

If the check boxes appear shaded, the file or folder has inherited permissions from the parent folder. There are three ways to make changes to inherited permissions:

Make the changes to the parent folder, and then the file or folder will inherit these permissions.

Select the opposite permission (Allow or Deny) to override the inherited permission.

Clear the Allow inheritable permissions from parent to propagate to this object check box. Now you can make changes to the permissions or remove the user or group from the permissions list. However, the file or folder will no longer inherit permissions from the parent folder.

If neither Allow nor Deny is selected for a permission, then the group or user might have obtained the permission through group membership. If the group or user has not obtained the permission through membership in another group, the group or user is implicitly denied the permission. To explicitly allow or deny the permission, click the appropriate check box.

Default Settings

The following section describes the default permissions provided to different users.

Default File System and Registry Permissions

Table 13.6 describes the default file system and registry permissions.

Table 13.6 Default Settings for User Write Access

File System Permissions for Power Users and Users

Table 13.7 describes the default access control settings that are applied to file system objects for Power Users and Users during a clean installation of the Windows 2000 operating system onto an NTFS partition. For directories, unless otherwise stated (in parentheses), the permissions apply to the directory, subdirectories, and files.

%systemdir% refers to %windir%system32.

*.* refers to the files (not directories) contained in a directory.

RX means Read and Execute.

Table 13.7 Default Access Control Settings for File System Objects

Note that a Power User can write new files into the following directories but cannot modify the files that are installed there during text-mode setup. Furthermore, all other Power Users inherit Modify permissions on files created in these directories.

%windir%

%windir%config

%windir%cursors

%windir%fonts

%windir%help

%windir%inf

%windir%media

%windir%system

%systemdir%

%systemdir%OS2

%systemdir%OS2DLL

%systemdir%RAS

%systemdir%Viewers

For directories designated as [Modify (DirSubdirs) RX (Files)], Power Users can write new files; however, other Power Users will only have read access to those files.

Registry Permissions for Power Users and Users

Table 13.8 describes the default access control settings that are applied to registry objects for Power Users and Users during a clean installation of the Windows 2000 operating system. For a given object, permissions apply to that object and all child objects unless the child object is also listed in the table.

Table 13.8 Registry Permissions for Power Users and Users

For more information, see the Distributed Systems Guide in the Windows 2000 Server Resource Kit.