User Rights

Previous articles in Windows NT Magazine have discussed user rights from the point of view of securing your system and protecting it from hackers and external attacks. (For a selection of such articles, see "Related Articles in Windows NT Magazine," page 207. For more about protection from hackers, see Andrey Kruchkov, "The Accidental Hacker," page 177.) This article looks at how you can assign or remove user rights to gain flexibility in delegating tasks while you maintain control of your NT network.

Permissions and Rights
A systems administrator assigns a permission to let a user access a resource such as a file, a directory, or a printer. The administrator assigns a right to let a user perform a task such as changing the system clock time. A permission is always associated with an object, and a right is always associated with the system.

Setting User Rights
You configure rights with the User Manager utility. On a domain controller, you configure rights from the User Manager for Domains, which lets you set rights that apply to the domain. From the Policies menu, select User Rights to open the dialog box and configure rights for your users. When you first open the User Rights dialog box, you'll see only basic, or standard, user rights. To view a larger and more advanced group of user rights in the drop-down list, select the Show Advanced User Rights check box, as you see in Screen 1, page 206.

You can assign each right to individual users or to groups of users. NT automatically assigns many rights to specific groups. For example, on a domain controller, NT assigns the log on locally right to the Administrators, Account Operators, Server Operators, and Backup Operators groups. NT does not assign this right to Domain Users or to the Everyone group because users in these groups will usually access the server across the network and will not log on at the server.

NT assigns certain rights by default to the Everyone group. This assignment might be too liberal on NT's part, and some administrators like to substitute Domain Users for the Everyone group to maintain more control over these rights.

To assign a right, select the right and click Add to bring up a list of users and groups, from which you select the appropriate items, as Screen 2, page 206, shows. I recommend adding a user account to an established NT group that already has the right you're assigning. You can assign rights to global groups, local groups, and users from current and trusted domains.