IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Hardware & Software Remarks
____________________________________________________________________ .........................................
Local groups are represented in the User Manager by a group symbol with a
computer.
Global groups
If a computer on which Windows NT is being run belongs to a domain, there
is a further type of group for which access to the workstation can be made
possible. This is the "global group", which can be used in several places: in its
own domain, on servers, on workstations of the domain and in trusted
domains. If a workstation belongs to a domain, it means that permissions and
rights to the local workstation and membership of local groups of the
workstation, can be granted to the global groups of the domain and the trusted
domains. A global group can only contain user accounts from its own domain.
Global groups can only be defined on the primary domain controller. It is not
possible for other groups to become members of a global group. Global
groups are represented in the User Manager by a group symbol with a globe.
To sum it up, it is recommended to structure the system administration as
follows:
Rights and permissions are assigned to local groups. Users become members
of global groups and the global groups become members of local groups.
In addition to the distinction between local and global groups, there is also a
distinction between pre-defined user groups, special groups and freely-defined
user groups.
Pre-defined user groups
The actions a user can perform depend on the group memberships of his user
account. Several groups are pre-defined in Windows NT and each group is
granted a particular set of user rights as standard. Where required, additional
groups can be created and defined via the User Manager. With these groups,
access to individually-compiled resources is made possible for the users
assigned to them.
In addition to the rights, pre-defined functions are allocated to some of the
pre-defined local groups. Rights and access permissions can be granted
directly to the groups and user accounts and withdrawn from them. On the
other hand, the pre-defined functions cannot be administrated directly. Predefined
functions can only be provided for a user if the user is made member
of a suitable local group.
On computers which are configured with the operating system Windows NT
as member server (a server which does not have the function of a domain
controller) or as a workstation, the following local groups are set up during
installation by default.
- Administrators
- Back-up operators
- Power users
- Replication operators
- Users
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000