- [Narrator] Roles provide administrators
with an easy way to manage security permissions.
Administrators can create roles,
which group permissions together in a manner that
they may be assigned to multiple users at the same time.
In Windows, we can use security groups
to manage roles and their permissions.
The major benefit of roles
is that they simplify account management.
When a new user joins a team,
administrators can simply assign that new user
to the team's role and then the user will get
all of the permissions already
associated with their new job.
When the user leaves, the administrator
may remove the role and those permissions go away.
Roles also eliminate the need for
dangerous account practices;
The use of shared and generic accounts.
In some organizations,
administrators create generic accounts,
such as one for the HR Department or for all receptionists.
This way, administrators don't need to
create new accounts for each user
and manage the permissions on those accounts.
The danger with this approach is that it becomes
difficult to track who performed actions on the system
and also requires changing generic account passwords
when anyone when anyone who knows them
leaves the organization.
Lets go through an example of creating
security groups on a Windows server.
We'll create groups for employees in our
Human Resources and Accounting Departments.
From server manager, we go to the tools menu
and choose active directory users and computers.
We can right-click on the users folder in our domain,
select new and then group from the pop-up menu.
Our first group is for employees
in the Human Resources Department.
So, lets give it that name and then leave
the default settings that we are creating
a global security group.
You can see here that the
Human Resources Security Group now exists.
If we look at the properties for that group,
we see a members tab.
This is where we can add new members to the group.
Lets go ahead and add Alice Jones
by typing in her ID and clicking the check names button.
And you can see we've added Alice
and lets also add Carol Adams to this group.
We now have two members in the Human Resources Group.
We can then repeat this process
to create a group for Accounting.
New group, we'll call it Accounting.
It should also be a global security group and click okay.
And here's our new group.
And I'm going to click on the properties for that group,
the members tab, and then I'm going to add Bob Andrews
and also go ahead and add Tom Smith to this group.
I've now added two users to the accounting group.
If we now switch over to the documents folder
and go into the security properties for our employee file,
we can add permissions here for the human resources group,
just as we would for an individual user.
Lets go ahead and do that, we'll add
and we will just type in human resources,
the name of our group.
Click check names and it verifies with the underline there.
We'll click okay and then we're going to give
the human resources group full control of this file.
And you can see they've been added here
just like the regular users
that also have access to this system.
The benefit of using groups is now that when
users leave the HR Department,
we can simply remove them from the HR group
and they will lose all permissions
assigned to that security role.
Similarly, when a new employee joins HR,
adding them to the security group gives them all
of the necessary permissions to work in Human Resources.