19.12.2012 Views

IT Baseline Protection Manual - The Information Warfare Site

IT Baseline Protection Manual - The Information Warfare Site

IT Baseline Protection Manual - The Information Warfare Site

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

Safeguard Catalogue - Hardware & Software Remarks<br />

____________________________________________________________________ .........................................<br />

Note: This group should be used to define sub-system administrators who<br />

relieve system administrators of the burden of certain routine tasks,<br />

especially in connection with the administration of user accounts without,<br />

however, receiving full control over the system.<br />

- Accounts operators - <strong>The</strong> local group "Accounts operators" defined on<br />

domain controllers largely corresponds to the "Power users" group defined<br />

under Windows NT Workstation.<br />

- Users - Membership of the local group "Users" offers the functions a user<br />

needs for carrying out everyday tasks. With the exception of the predefined<br />

administrator and guest accounts, all the workstation’s user<br />

accounts belong to the "Users" group. If a new user account is added, it<br />

automatically becomes a member of this group. If a computer belongs to a<br />

domain, the domain users group is a member of the "Users" group of this<br />

computer as standard.<br />

Note: All users who do not require any extended rights should usually only<br />

belong to this pre-defined group and to suitable freely-defined groups<br />

which reflect the organisational structure. Allocations to other pre-defined<br />

groups should only be made in justified individual cases. This also means<br />

that users should not receive any administrator rights on their workstation<br />

computers.<br />

- Domain users - <strong>The</strong> global group "Domain users" originally contains the<br />

built-in account of the administrator for the domain concerned. When new<br />

accounts are created, these are automatically entered into the "Domain<br />

users" group. As standard, this group is a member of the local group<br />

"Users" for the domain concerned and of the local groups "Users" of each<br />

computer in the domain, so that the "Domain users" have normal access<br />

and normal rights and permissions in relation to every computer in the<br />

domain.<br />

- Guests - <strong>The</strong> local group “Guests“ enables the occasional or one-time user<br />

to log on and to work with a restricted range of functions. <strong>The</strong> pre-defined<br />

guest user account is a member of the “Guests“ group. <strong>The</strong> resource<br />

permissions granted to the "Users" group can be withheld from the<br />

“Guests“ group, so that the capabilities of the members of this group can be<br />

suitably restricted.<br />

Note: If possible, no further user accounts should belong to this group<br />

apart from the pre-defined guest account, and the pre-defined guest account<br />

should be locked out (see S 4.55 Secure Installation of Windows NT). As<br />

an additional precaution it should be provided with a password to prevent<br />

unauthorised access in case it is unlocked for a short time.<br />

- Domain guests - <strong>The</strong> global group "Domain guests" originally contains the<br />

built-in guest user account for the domain concerned. This group is a<br />

member of the local group of guests for the domain concerned.<br />

- Back-up operators - <strong>The</strong> members of the local group "Back-up operators",<br />

which is a standard group on all computers under Windows NT, can save<br />

and restore files and directories.<br />

____________________________________________________________________ .........................................<br />

<strong>IT</strong>-<strong>Baseline</strong> <strong>Protection</strong> <strong>Manual</strong>: Oktober 2000

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!