Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Are there any best practices for "temporary worker" accounts in a Windows server environment?

We have a couple of contractors joining the organization temporarily. They only need access to a few folders.

Aside from joining them to the "Domain Guests" group and granting them access only to the folders specified. Are there any other issues to be aware of?

We are in a Windows Server 2003 domain environment.

share|improve this question

If you know when they will be leaving, the Account Expiration attribute is worth exploring.

share|improve this answer
+1, Even if you don't know, set if for 2 weeks (or whatever reasonable time period) and put a post-it on your monitor to keep extending that every 2 weeks. – Chris S Apr 16 '10 at 22:40
thanks! their enrollment does not have a "set" enddate. It is rolling. – Millman Apr 19 '10 at 13:10

You don't mention email, so maybe they don't need it, which will save some hassle. When we've had temporary contractors that needed to send email, we usually set up generic accounts for them (e.g. marketing-assistant) and hoped to re-use them if that department needed contractors in the future.

You probably want to keep track of which workstations they'll use (and possibly restrict them to logging in to specific machines) and remember to delete their profiles after they've gone.

Printing: you might also want to limit them to specific printers.

share|improve this answer
thanks! they don't need email or in-house printing. they just need access to specific folders. I guess I was wondering if there was specific significance between the Domain Users group and the Domain Guests group. – Millman Apr 19 '10 at 13:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.