Security Templates suggestions

[gibilix]

Hello,

I need to configure security of a standard Windwos XP based desktop
kit.
We are satisfied with the default security settings regarding the
Users
group, but we need to a support group where technicians from the
HelpDesk
can install and configure almost everything like an administrator, but
they have
to be denied access to the c$ share and they cannot change the
Administrator password.

For this reason I am exploring the possibility of using a custom
security template. Here are my
questions:

1) Is it better to customize a builtin sucurity group like Power User
or create a new
specific group like Support? Considering that I need something that is
much closer to the
Administrators group rather than the Power Users group, I thoght that
the second solution is convenient.

2) Can this new custom group be a Local group or it must be a Domain
group? I have tried to assign a privilege to another
group vie security templates, but it lets me pick only builtin Local
groups and domain Users/Group. I don't know if this is by design or if
there is something wrong I am doing.

I would appreciate any kind of suggestion on this matter, because I am
new to it...

Thanks in advance.

gibilix

 

[Steven L Umbach]

I don't think a security template can do what you want as I think you basically are
considering configuring user rights which probably will not accomplish what you want.
For installing software and devices they will need to be at least power users and if
they are members of the network configuration group they can configure tcp/ip
settings. Power users are only found in the local groups on the domain computers.
Keep in mind also that local administrators have no special powers in the domain and
can not change domain administrators passwords nor access administrative shares on
domain controllers. You can also give regular users the power to change passwords of
non administrators in an OU by using delegation for that OU. --- Steve