Home / server / Questions / 308482
Accepted
Rory
Asked: 2011-09-07 00:21:13 +0800 CST

creating security groups from scratch - best practices

  • 772

I need to create security groups in AD. I can identify the groups that I need, let's say they are: Management,Finance,Sales & Engineering. And I can identify the resources that each group requires access to (though this could be a tedious task). And I can identify levels of access required.

Most companies add security groups as needed. But this is a situation where the company is already mature but has never used security groups before. Are there best practices for implementing security groups? Are there any tips? Or pitfalls to avoid? And does anyone know of any tool that could speed up the group->resource mapping process?

security active-directory permissions user-permissions file-permissions

2 Answers

  1. Best Answer

    The way I have implemented it, based on Microsoft's recommendations for Windows Server 2003 (found in the MCSE Self-Paced Training Kit for exam 70-294: Planning, Implementing and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure) is:

    • Create a global security group for each position within the organisation (eg, CEO, Sales Director etc)
    • Create a domain local security group for each resource (or two groups if you are giving some people read-only premission and others modify permission) (eg, Sales File Modifiers, Marketing Data Readers)
    • Assign permissions to your resources, using the domain local security groups (eg, Give Modify permissions on the Sales Files to the Sales Files Modifiers groups)
    • Assign users to the relevant global security groups (eg, make your CEO a member of the CEO security group)
    • Add the global security groups to the relevant domain local security groups (eg Add the Sales Director group to the Sales Files Modifiers group)

    So you have: User Account -> Job Role security group -> Resource Permission security group -> Resource Permissions

    Doing it this way, you can end up with a lot of groups, particularly domain local groups, if you have a lot of resources, but it keeps it relatively simple and maintainable. Trying to get clever and having multiple levels of nested groups is a recipe for complexity and disaster, trust me!

    It would also be a good idea to ensure that no-one other than Administrators has Full Control of any files. This prevent s users trying to be too clever and configuring their own permissions.

    • 6

  2. Without knowing your environment it's hard to give you specific advice, but to paint with the broadest possible brush I'd suggest that you follow the Policy of Least Privilege in all your permission-delegating.

    hmallett's advice combined with the mentality behind the Policy of Least Privilege will give you a very flexible, yet fairly secure environment.

    • 0