Active Directory Accounts

Active Directory Accounts There is a lot of default groups for users called built in groups. In this paper I will be addressing four of them and the security and risk that arise with them. First we have the administrators group, in this group there are not many users do to the amount of permissions that are bestowed upon the user. They have complete control over everything otherwise known as Full Control which means they can read write execute modify and delete but believe you me myself would detour anybody but a certain few the power to delete. So by default the built in group Administrators gives full control so only a select few will be put into this group and in most cases just one person. Also the administrators group allows the user to have complete control over the domain controllers to add users and set permissions. So the only people you would ever see in this group are Network Administrators. There are a lot of other things this group can do but for this paper that’s all I’m getting into. The next built in group I’ll be talking about is the Account Operators with this account the users are limited when it comes to permissions. They can modify and delete user and user group information but only on their local domain but they can’t modify anything having to do with administrators. So locally they could cause a threat to local groups and users but across the network they have no control so if there is an issue to arise cause by a member in this group you can pin point it to their LAN. Ok now with this next group, no one is in this group by default they have to be physically being placed in this group because of the special task they have to perform. This group is called the Backup Operators group. In this group the network administrator assigns mostly one person if any at all this special permission gives the user a major amount of responsibly, it allows them to restore all files on any domain controller regardless of their file permissions. This can open up a can of worms if the user doesn’t quite know what they’re doing. This group could potentially cause a server to crash and could remote in to and shut down the wrong domain controller. So as a network administrator you want to pick whom you can trust not to screw things up. Then we have the built in group called Network Configuration Operators this is also another group that you want to give some thought to who you add to it. It gives the user permission to change the IP configurations which could screw up the whole domain structure if they change the wrong thing and also gives them ways to leave the network wide open to threats. When dealing with groups there different scopes in which you can assign to them. One is local and the other is universal with domain local groups the users are limited on how far there permissions reach with inside the network. You would assign a user to this group if they were stationary to that location. Next we have the universal domain group which allows the user to stretch their permissions across the network to different locations. The nesting of groups comes into play when you say you have you have a group set up to do certain things inside of a set of folders and a new part of the company needed the same permissions to these files and folders instead of adding all these users one by one you would take the new company group and add the whole group to the preexisting companies group. There are three different group types you have distribution, security, and universal, distribution groups are used for basic groups like mailing list and such. Global is the most commonly used group today because you can manipulate permissions after group is created and there very easily nested but only on local domain. With universal groups, if you want permissions to stretch across the network over multiple domain controllers within the same domain then this is your best bet. One process that can be used to create multiple users or groups is a process called “LDIFDE” in this process you can do just about everything you create and modify delete and export user and group info “Sweet” you have to run this from the command line but it’s very effective. But make sure you run CMD as an administrator. From there you can retrieve names user, groups, objects, move, add, and create. Methods for monitoring and maintaining group accounts are active directory is a great way to maintain and monitor groups and users.