IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Hardware & Software Remarks
____________________________________________________________________ .........................................
Note: Data back-ups and the recovery of saved data should be carried out
by a member of this group. For this it is not necessary to use an
administrator account.
- Print operators - The members of the local group "Print operators"
defined on domain controllers can administrate printers on the domain
controllers. They can also log on to these servers and shut them down.
Note: The administration of printers should be carried out by members of
this group in order to avoid the unnecessary use of administrator accounts.
- Server operators - The members of the local group "Server operators"
defined on domain controllers can administrate the printer and network
shares on the domain controllers. Furthermore, they can save and recover
files and directories, block and release the domain controller, format the
hard disks of the domain controller and alter the system time. Finally, they
can also log onto the domain controller and shut it down.
Note: Routine tasks involved in controlling the domain controllers should
be carried out by members of this group, insofar as they can be carried out
with the rights of this group. Only tasks which require full control over the
system should be carried out from administrator accounts.
- Replication operators - The local group "Replication operators" defined on
computers under Windows NT supports the functions of directory
replication. A domain user account used for logging on the replication
service of the workstation should be the sole member of the group
"Replication operators" .
Note: No users accounts should be added to this group, and the user
account present there should not have the rights "Local log-on" and
"Access to this computer of the network".
Special groups
In addition to the above-mentioned pre-defined groups, Windows NT creates a
number of special, internal groups which are not listed by User Manager. In a
good many cases, however, they are listed in the group list, for example when
permissions are assigned to directories, files, released network directories or
printers.
- Everyone - Everyone who works on the computer. Included here are all
local and remote users (i.e. the groups "INTERACTIVE" and "NETWORK"
put together). They can access the network, connect with the shared
network directories of the workstation and use the printer of the
workstation.
- INTERACTIVE - Everyone who works locally on the computer.
- NETWORK - All users who are connected with this computer via the
network.
- SYSTEM - The operating system.
- CREATOR-OWNER - The user who has created or owns the following: a
directory, a file in a directory, a printer or a document that was sent to a
printer.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000