Security Groups

On a fresh SBS 2000 box that will replace our old one, I
want to assign security groups. There will ultimately be
three types of security groups: high, med, low - where
the high group will allow users to have full Admin access
to their machines, med will have semi-admin access and low
will be no admin rights at all.

Currently, we do not use security groups on the SBS
domain. All I do is take off Local Admin rights for each
user - so they cannot install/uninstall programs, move
files into the System/WINNT folders or change the clock.
Some software needs registry tweaks for it to work under
these conditions.

I want to deploy these three groupings (or maybe just two -
high and low), where I will assign myself "high" (as I
constantly add/remove software from my machine) and "low"
to all users so that they cannot do anything!

How do I set up these groupings and the necessary tasks
before I add the users one-by-one to AD and assign them to
the groups.

I need step-by-step help as I have not done this before.

skc

Susan
Thu Oct 23 14:46:40 CDT 2003

Win2k already has this.... admin, power user and users. Have you looked
at this security groups that are already included?

skc wrote:
> On a fresh SBS 2000 box that will replace our old one, I
> want to assign security groups. There will ultimately be
> three types of security groups: high, med, low - where
> the high group will allow users to have full Admin access
> to their machines, med will have semi-admin access and low
> will be no admin rights at all.
>
> Currently, we do not use security groups on the SBS
> domain. All I do is take off Local Admin rights for each
> user - so they cannot install/uninstall programs, move
> files into the System/WINNT folders or change the clock.
> Some software needs registry tweaks for it to work under
> these conditions.
>
> I want to deploy these three groupings (or maybe just two -
> high and low), where I will assign myself "high" (as I
> constantly add/remove software from my machine) and "low"
> to all users so that they cannot do anything!
>
> How do I set up these groupings and the necessary tasks
> before I add the users one-by-one to AD and assign them to
> the groups.
>
> I need step-by-step help as I have not done this before.
>
> skc

--
"Don't lose sight of security. Security is a state of being,
not a state of budget. He with the most firewalls still does
not win. Put down that honeypot and keep up to date on your
patches. Demand better security from vendors and hold them
responsible. Use what you have, and make sure you know how
to use it properly and effectively."
~Rain Forest Puppy
http://www.wiretrip.net/rfp/txt/evolution.txt