The rights assigned to an account determine exactly what type of actions the user is allowed to perform. For instance, if a user's account has the Log on locally right, he can log on to the server at the console. To simplify assigning rights to each account, you assign those rights to groups and then define which accounts are members of each group.
This appendix is a quick reference that you can use to look up the purpose of each group and the default rights assigned to each group on a domain controller. You learn in detail how to work with user accounts and groups in Chapter 21, "Administering Users and Groups."
Table E.1 describes the default local groups that NT creates for each domain controller. The first column contains the name of the group, and the second column describes the capability that the group has by default.
| Group | Description |
| Account Operators | Can use User Manager for Domains to maintain accounts and groups, log on to domain servers, shut down domain servers, and add computers to a domain. |
| Administrators | Has every built-in right and capability and thus has full control over a server. The global group Domain Admins is a member of Administrators. |
| Backup Operators | Can back up and restore files on the domain server, log on to the domain server, and shut down the domain server. |
| Guests | Can log on locally or remotely and have no rights on a domain server. The global group Domain Guests is a member of Guests. |
| Print Operators | Can manage printer shares on a domain server, log on to a domain server, and shut down a domain server. |
| Replicator | Can use directory replication functions. |
| Server Operators | Can manage file and printer shares, back up and restore files, lock and unlock servers, log on to and shut down servers. |
| Users | Can log on to a server. The global group Domain Users is a member of Users. |
Tables E.2 and E.3 describe the standard and advance user rights defined in NT. The first column contains the name of the right. The second column gives you a brief description of what that right enables. The third column lists the groups that have that right by default.
| Right | Description | Default Members |
| Access this computer from network | Enables users in the Specified groups tolog on to the server via the network. Thisright only controls network access to the server. | Administrators Everyone |
| Back up files and directories | Enables users in the specified groups to back up files on the server. This right enables a user to get around NTFS security to perform the backup. | Administrators Server operators Backup operators |
| Change the system time | Enables members of the specified groups to set the server's system clock. | Administrators Server operators |
| Force shutdown from a remote system | This right is not implemented, but it is intended to enable members of the specified group to remotely shut down a server. | Administrators Server operators |
| Log on locally | Enables members of the specified groups to log on to the server at the console with interactive access. This right does not permit a user to log on to the server via the network. | Administrators Server operators Backup operators Print operators Account operators |
| Manage auditing and security log | Enables users in the specified groups to work with the security logs and configure auditing. | Administrators |
| Restore files and directories | Enables members of the specified groups to restore backup files the server, getting around NTFS security. | Administrators Server operators Backup operators |
| Shut down the system | Enables members of the specified groups to shut down the system from the server's console. | Administrators Server operators Backup operators Account operators Print operators |
| Take ownership of files or other objects | Enables members of the specified groups to assume ownership of any NT objects, including files and folders. | Administrators |
| Right | Description | Default Members |
| Act as part of the operating System | Enables members of the specified groups to bypass some operating system controls. The SYSTEM account always has this right. | None |
| Add workstations to domain | Enables members of the specified groups to create NT computer accounts in the domain. | None |
| Bypass traverse checking | Enables members of the specified groups to access resources for which they have permission even though they don't have access to the parent resources. | Everyone |
| Create a pagefile | Enables members of the specified groups to create a pagefile. | Administrators |
| Create a token object | Enables a process to create security tokens that are built when a user logs on. | None |
| Create permanent shared objects | Enables members of the specified groups to create permanent shared objects, which is not the same thing as creating network shares. | None |
| Debug programs | Enables members of the specified groups to have full access to all system-level processes. This right is provided for programmers who need it to debug programs. | Administrators |
| Generate security audits | Enables members of the specified groups to run programs that create entries in NT's security logs. | None |
| Increase quotas | Enables members of the specified groups to increase object quotas. This is not implemented. | Administrators |
| Increase scheduling priority | Enables members of the specified groups to increase the priority of an NT process. | Administrators |
| Load and unload device drivers | Enables members of the specified group to install and uninstall device drivers. | Administrators |
| Lock pages in memory | Enables members of the specified groups to lock a page in memory so it can't be swapped out. | None |
| Log on as a batch job | Enables members of the specified groups to log on to the server using a batch job. This is not implemented. | None |
| Log on as a service | Enables members of the specified groups to log on to NT as a service. | None |
| Modify firmware environment variables | Enables members of the specified groups to | Administrators |
| change settings stored in nonvolatile RAM. | ||
| Profile single process | Enables members of the specified groups to use NT's performance monitoring tools to examine the performance of a single process.This is not currently implemented. | Administrators |
| Profile system performance | Enables members of the specified groups to profile NT's performance. | Administrators |
© Copyright, Macmillan Computer Publishing. All rights reserved.