Seeking RBAC solutions for managing services & shares
i looking azman solution delegate hyper-v management want do... several services including restarting print spoolers , managing shares.
it looks windows authorization manager not matured point can used rbac administrative tasks without developing canned store 1 ships hyper-v.
has looked and/or found way rbac administrative tasks, delegated local staff without putting them in local administrators or power users group example?
unfortunately role based administration more of philosophy product implement. while microsoft allows type of administration via standard methodology of domain global groups domain local groups local group to assign permissions format....its administrator develope implement appropariate role based groups company. why philosophy...
to properly administer individual services (or anything) via roles need several layers of groups.
first need groups manage permissions. can use subinacl assign group permissions start, stop, pause, interogate service. subinacl can used manage permissions on object types.
secondly, need group allow enumeration of services remotely. without ability manage services limited console or rdp session only.
third, need a server level role based group tie these 2 permissions together. done making group member of 2 pervious groups.
fourth, need repeat above several servers.
fifth, need create role based group to manage services on multiple servers. place group in server level role based group created ealier.
this configuration setups role based administration service or collection of services, collection of servers, while still allowing individual servers , services managed well. type of configuration provides best long term manageability of environement. while other shortcuts can taken solutions not flexibile on time.
more information:
http://networkadminkb.com/shared%20documents/axioms%20of%20permissions%20administration.aspx
Windows Server > Security
Comments
Post a Comment