Professional Windows Server 1002003 Security A Technical Reference [Electronic resources] نسخه متنی

1.

Determine which custom roles are necessary. Custom roles may be administrative, such as a Help Desk role to assist in managing computers and instructing users, or they may relate to job functions in individual departments, such as Accountants or Accounting Clerks.

2.

Determine the computer access and the resource access required by each group to perform its role. Use these questions to help you do so. Do its members need access to every computer? Do they need access to specific resources on the computer? What are these resources? Files? Printers? Folders? What type of access do they need? Print? Read? Write? Execute? Are there resources that they should be explicitly forbidden from using? Are there mutually exclusive roles? That is, if a user has one role, should he be excluded from the other? (An example of mutually exclusive groups are accounts payable clerks and accounts receivables clerks.)

3.

Create one user group on the server for every distinct role. If two roles need the same access, then perhaps you need to refine your roles or combine two roles into one.

4.

Grant this group the level of access required, as determined in step 2.

5.

If this group and another are mutually exclusive, deny each group access to the resources the other group has privileges for.

6.

Create one user account for each user.

7.

Give user memberships in the groups that represent the roles that users must play.