Win NT Admin Help

>-----Original Message-----
>Please answer this question!
>You are the admin of a network that consists of two Win
NT
>domains, which are named VHHICAGO and DENVER. The domains
>are configured as a complete trust domain model. Each
>domain contains Win NT server computers and Win NT
>workstation computers. You hire a new assistant admin
>named Marie. She will be responsible for creating,
>configuring, and managing all printers on alll servers in
>both domains. Marie has a user account in the DENVER
>domain. You want to assign Marie the fewest permisstions
>possible. What would you do?
>Thank Driftwood.
>.
>

Hi Driffwood,

Add the Marie's user account to Print Operators Group on both the domains.
Print Operator has following permission. If you need to allow more
permission to marie refer the document below which gives information
default groups and theor rights. Accordignly you may add to group depending
on the requirement.

Print Operators

Members of the Print Operators local group can create, delete, and
manage printer shares on the domain's primary and backup domain
controllers. Print Operators can also log on at these servers, and
shut them down.


Other default Groups and their Permission for your reference.

BUILT-IN GROUPS
---------------

The actions a user can perform depend on the group memberships of his
or her user account. Several built-in groups are provided with
Windows NT,
and by default each of these groups is granted a particular set of
user rights.

In addition to rights, some of the built-in local groups are granted
built-in abilities. Although rights can be directly granted to and
removed from groups and user accounts, these built-in abilities are
not directly administerable. The only way for you to provide these
built-in abilities to a user is to make that user a member of
the appropriate local group.

The rights and built-in abilities granted to the built-in local groups
on Windows NT domains are shown in the following table. In most
situations these built-in local groups provide all the capabilities
needed by the users of a domain. The built-in global groups of a
domain are not shown in this table because the built-in global groups
receive their rights and abilities indirectly, through their
memberships in built-in local groups.

To provide these rights and built-in abilities to a user, add the
user's account to the appropriate group. Following are brief
discussions
of each built-in group.

Administrators


The Administrators local group is the most powerful group in the
domain. Members of this group have more control over the domain than
do any other users. They manage the overall configuration of the
domain and the domain's servers. The built-in Administrator user
account is a member of the Administrators local group, and cannot be
removed. By default the Domain Admins global group is also a member of
this local group, but it can be removed.

Note that administrators do not automatically have access to every
file in the domain. If a file's permissions do not grant access, the
administrator cannot access the file. Every file on an NTFS volume has
an owner, who can set permissions on the file. If needed, an
administrator can take ownership of a file and thus have access to it.
But if the administrator does so, this event is recorded in the
security log (if auditing of files is turned on), and the
administrator cannot give ownership back to the original owner. For
more information, see Chapter 4, "File Manager."

Domain Admins


The Domain Admins global group is a member of the Administrators local
group for the domain, and of the Administrators local group for every
Windows NT computer in the domain.

The built-in Administrator user account is a member of the Domain
Admins global group.

Because of these memberships, a user logged on to the Administrator
account is able to administer the domain, the primary and backup
domain controllers, and all other Windows NT computers in the domain.
(However, if you want to prevent Domain Admins from administering a
particular workstation or a server that is not a domain controller,
you can remove the Domain Admins global group from that computer's
Administrators group.)

To provide administrative-level abilities to a new account, it should
be made a member of the Domain Admins global group. This allows that
user to administer the domain, the servers and workstations of the
domain, and trusted domains that have added the Domain Admins global
group from this domain to their Administrators local group.



Hope this helps to resolve the issue.

Regards
Krishna Bhat

This posting is provided "AS IS" with no warranties, and confers no rights.