I am a consultant working on a long-term tech project for a small group. The small group (~150 people) has recently moved to Windows 2000 Active Server with primarily Windows 2000 clients. The 3 tech support people have locked us down so tight with security that it has become very difficult to work. No one but the 3 tech support staff has anything other than basic “user” rights on the network–no one has local administrator rights on their own computers. No one can create folders on the file server, nor share folders on their computers. The division managers have not been consulted about what permissions should be given to their staff or what data on the file servers must be secure and what should be shared. In my opinion, the tech staff has run amok, but I am curious as to what the climate is in other organizations.
What criteria should be used to determine who has what kind of network administrative access? Who should have input in the design of the network organization (organizational units and domains)? What role should network administrators have in determining permissions in an organization? What role should division managers (2nd layer management) have?
Can anyone direct me to articles or other pertinent sites that address this question?
