IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Hardware & Software Remarks
____________________________________________________________________ .........................................
Note: The rights outlined above, which are allocated under Windows NT as
standard, must all be reviewed separately with a view to determining whether
they are compatible with the security strategy laid down (see S 2.91
Determining a security strategy for the Windows NT client-server network).
Thus, for example, the right “Access to this computer from the network“
should be withdrawn from the group “Everyone“. Whether it is granted
alternatively to the group “Users“ must be clarified in detail.
The following pre-defined groups are available under Windows NT:
- Administrators - The "Administrators" group is the most powerful group in
Windows NT. The members of this group administrate the overall
configuration of the system. The pre-defined "Administrator" user account
is a member of the "Administrators" group. If a computer belongs to a
domain, the "Domains admins" group is automatically a member of the
"Administrators" group of this computer.
Note: User accounts of this group should only be used for system
management tasks which require full control over the system. Tasks which
can be carried out under restricted rights should, if possible, be performed
from user accounts which belong to one of the other groups, in order to
reduce endangerment to the system from tasks with unrestricted rights. In
particular, a user account which only belongs to the group "Users" or one
or more freely-defined groups should be created for every administrator for
performing daily routine tasks. The number of user accounts in the group
"Administrators" should be kept as small as possible.
Administrators are subject to normal access control and do not
automatically have access to every file. Where required, an administrator
can assume ownership of a file and thereby access it. However, in such a
case the administrator cannot pass the file back to the original owner, as
Windows NT does not provide a function for this purpose.
- Domain admins - The global group "Domain admins" is a member of the
local group of administrators for the domain in question and of the local
groups of administrators of each computer in the domain, with the result
that the domain administrators can administrate the domain controllers,
every server and all other computers in the domain. The pre-defined
administrator account of the domain controller is a member of the "Domain
admins" group.
- Power users - The local group "Power users" defined under Windows NT
Workstation makes restricted administrative functions available to the user
accounts of its members. A power user can share directories in the
network, set the internal clock of the computer, install, share and
administrate printers, and create general program groups. They can create
user accounts and groups, change or delete the user accounts and groups
that they have created, and add or remove members from the groups
"Power users", "Users" and "Guests".
However, power users cannot change or delete the groups
"Administrators", "Domain admins", "Accounts operators", "Back-up
operators", "Print operators" and "Server operators", neither can they
change or delete any administrators’ user accounts.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000