Active Directory - User Rights [closed]

Question

I'm building an environment in which I'm using Active Directory primarily for:

• Centralized authentication and authorization for our servers (Linux and Windows)
• Single Sign On for various of our services (SAML, etc)
• Enterprise PKI distribution

In our company, all employees have an elevated degree of freedom. We don't care which software they install on their computer and which sites they access. So, we'd like to maintain the following:

• All users can do almost anything they want in the computer they use (install software, navigate any website)
• Users can't access each other files
• Only infrastructure people can access the servers

Seems like this is an uncommon setup as we want to maintain all the users freedom (we even have bring your own device here).

What are the most important configurations I should do in this case? There's a lot of default GPOs that block a lot of things for standard users.

Answer 1

• All users can do almost anything they want in the computer they use (install software, navigate any website)

• Users can't access each other files

• Only infrastructure people can access the servers

For points (1) and (2) above, make sure to give users local admin rights just to the laptops that use.

For point (3), make sure to give infrastructure users domain admin rights.

Additionally, if as you say, laptops are used out of the office most of the time, then you may want to enable BitLocker on the laptops as well.

Answer 2

Under the normal and default settings/configuration standard users can't access servers administratively (if the servers and the user accounts and groups have been configured properly), standard users can't access other users files (if the files have been secured properly). If you add the appropriate standard user account to the local Administrators group on each computer then each user will have local Administrator rights on their computer only and will have no administrator rights on any other computer, server or in the domain.

Answer 3

Actually, what you describe here is the standard setting for users. Installing software might require local administrator privileges though. This depends on the software. Someone with local admin rights can access all files on the system though, including that of other users.

If you keep files on a NAS or similar, you can do the right management there and local admins will not have access to the files.

Accessing servers, when done through RDP, WinRM or similar will only be allowed for domain admins per default, anybody else will have to be added to the appropriate groups on the server.