Security

Ask something
Discussion Locked

Isolating Users

0 helpful
5 replies

by elze

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I support a multi-master NT 4.0 domain network. Each of the domains has a full (two-way) trust relationship with each other. Our legal and security departments have recently instructed me to come up with a method to segregate a number of current active users (certain contractors) from most
of our resources (file, print, etc.) in every existing master domain. These users currently have valid existing NT accounts in the existing master domains. It would be very tedious and time consuming to research
all the ACL?s on all the resources in each domain to ensure they do not have access where they don?t need to.

I?m considering deleting their current accounts and setting up a new domain that each of the master domains would setup as a trusted domain and then create accounts for each of these users in the new domain. This would make the segregation fairly painless and then it would be fairly easy to modify
the ACL?s of the resources in the master domains granting the required accessto the users/groups from the new trusted domain. The total number of users isn?t very large (should be under 30) so overhead creating the new domain and accounts would not be that significant.

However, I?m not sure this would be the most efficient method. One of the criteria specified by legal/security is that these users not be included in the Everyone group. Does anyone have any ideas, suggestions that would enable me to isolate these contractors from all of our resources and then be able to add them to specific ACL's while not including them in the Everyone group? Thanks in advance!!!

5 replies

by dc1

If you are using the Everyone group for security, well that means everyone. One option is create a global group and place the contractors in the group. Assign the group No Access to the resources that your legal department does not want them to have access to. I would also think about removing the Everyone group and using authenticated users or going even more granular and specifying the specific groups that need access to the specific resources. Can be a large administrative headache but will definately be more secure.

by cavedweller

One more case where if you had known in the beginning, you would have done something different.

I would create new groups as mentioned in the previous post. Take the time to add all users to at least one of the new groups. Take a "matrix" approach. For instance, salesman go in SALES, sales managers go in SALES and MANAGERS. This way you can easily restrict access by either type of employee or work area. Anticipate other requirements and plan for them now (so you don't have to do it again!)

This discussion is closed to new replies.