posted
My job has me now working with district applications in a school district. I kind of miss my old school that I got to use as a giant lab to test networking. I learned a lot there.
They have also missed me. I just got a call. A teacher wants to create a user name he can give to select students to go out and install software on teacher computers. (windows server 2003)
The idea is he can send his tech group out to do tasks and then reset the password when the tasks are complete. He set the username up as "Domain Admins."
I told him that is a bad idea because they can now access teacher/administrator folders, even tho the security is locked to only "administrator" or "Teacher and administrator"
Is there a way to modify permissions (or is there a preset group) that would give this techie username the privileges to add computers to the domain, install software, but keep them out of admin and teacher folders?
I know they would only have access for that period, but I think that is too exposed for any environment.
* there really is no network person over this school or anyone else they can ask. I set up this school on a domain because I thought it was a good idea and it gave me something to learn.
Posts: 2445 | Registered: Oct 2004
| IP: Logged |
Printer-friendly view of this topic
