Setting permissions 2

[doubleJ]

Setting permissions


NT4.0 Server Service pack6a.

Can anyone direct me in the right direction! I would to get white papers or a good link to information pertaining the "Hierarchy" of permission setting on a PDC. I know how to do it but I would like to clean up what exists. As the co. grew permissions are lousily used. I have read some things on how different "User groups" should be set up. Example: "Administrator" shouldn’t be used to logon to anything only as last resort. "Developers" should develop at a "User" level. Looking forward to your help

 

[KevinNY]

Welcome to the wonderful world of NT administration! I've never known a company in which the file/permissions structure didn't become ever more complex and almost unmanagable.
One of the places I go to for white papers on various subjects is

http://searchsystemsmanagement.techtarget.com/home/0,,sid20,00.html

In general permissions should be managed at the NTFS rather than the share level and permissions should be assigned to groups rather than to individual users.
Ideally none of us should log in with Admin rights when we're just performing routine work, as a practical matter most admins do log in with an account granting them admin rights. However, it is unquestionably bad practise to log in under the user name "Administrator".

- Kevin -

 

[yizhar]

HI.

All that was mentioned here is correct. Here are some additions:

* The shared folders structure should match as much as possible the security structure, so you can set permissions at the highest level possible in the folder tree.
For example, this can be the structure of your data drive:

SOFTWARE (USERS=READ, ADMINISTRATORS=FC) (Put here shared installation files and drivers)

DATA (ADMINISTRATORS=FC, USERS=?) - Under the data folder create subfolders to match departments, projects, or whatever needed, and set permissions for departments or whatever suits your organization.

USERS (ADMINISTRATORS=FC) - Under this create home folders for users giving each users FC to his own folder only.

For implementing the new permissions, you can use the free utility called Permiter from my signature.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[doubleJ]

Thanks to you both. This gives me a good start

doubleJ