|
Note
When user rights and privileges are correctly set, there is no longer a need for a Windows
network account for the root user (nor for any synonym of it) with a UNIX UID=0.
Initial user rights and privileges can be assigned by any account that is a member of the
Domain Admins group. Rights can be assigned to user as well as group accounts.
By default, no privileges and rights are assigned. This is demonstrated by executing the command
shown here:
root# net rpc rights list accounts -U root%not24get
BUILTIN\Print Operators
No privileges assigned
BUILTIN\Account Operators
No privileges assigned
BUILTIN\Backup Operators
No privileges assigned
BUILTIN\Server Operators
No privileges assigned
BUILTIN\Administrators
No privileges assigned
Everyone
No privileges assigned
The
net
command can be used to obtain the currently supported capabilities for rights
and privileges using this method:
root# net rpc rights list -U root%not24get
SeMachineAccountPrivilege Add machines to domain
SePrintOperatorPrivilege Manage printers
SeAddUsersPrivilege Add users and groups to the domain
SeRemoteShutdownPrivilege Force shutdown from a remote system
SeDiskOperatorPrivilege Manage disk shares
SeBackupPrivilege Back up files and directories
SeRestorePrivilege Restore files and directories
SeTakeOwnershipPrivilege Take ownership of files or other objects
Machine account privilege is necessary to permit a Windows NT4 or later network client to be added to the
domain. The disk operator privilege is necessary to permit the user to manage share ACLs and file and
directory ACLs for objects not owned by the user.
In this example, all rights are assigned to the Domain Admins group. This is a good
idea since members of this group are generally expected to be all-powerful. This assignment makes that
the reality:
root# net rpc rights grant "MIDEARTH\Domain Admins" \
SeMachineAccountPrivilege SePrintOperatorPrivilege \
SeAddUsersPrivilege SeRemoteShutdownPrivilege \
SeDiskOperatorPrivilege -U root%not24get
Successfully granted rights.
Next, the domain user jht is given the privileges needed for day-to-day
administration:
root# net rpc rights grant "MIDEARTH\jht" \
SeMachineAccountPrivilege SePrintOperatorPrivilege \
SeAddUsersPrivilege SeDiskOperatorPrivilege \
-U root%not24get
Successfully granted rights.
The following step permits validation of the changes just made:
root# net rpc rights list accounts -U root%not24get
MIDEARTH\jht
SeMachineAccountPrivilege
SePrintOperatorPrivilege
SeAddUsersPrivilege
SeDiskOperatorPrivilege
BUILTIN\Print Operators
No privileges assigned
BUILTIN\Account Operators
No privileges assigned
BUILTIN\Backup Operators
No privileges assigned
BUILTIN\Server Operators
No privileges assigned
BUILTIN\Administrators
No privileges assigned
Everyone
No privileges assigned
MIDEARTH\Domain Admins
SeMachineAccountPrivilege
SePrintOperatorPrivilege
SeAddUsersPrivilege
SeRemoteShutdownPrivilege
SeDiskOperatorPrivilege
|
