This lesson will be talking about security roles for senior administration.
Let's start so rule based administration in ADC s provides the ability to delegated the predefined permissions
that are available on a C to groups that you create in 80 Days for enterprise C S or the local security
account manager database for a standalone sees that are not domain members although you can assign C
permissions to a specific user object and a best practice.
It is recommended that you only do the get permissions to a group delegating to a group reduces the
required administrative effort and provides transparency of what permissions you have assigned each
role that you create should only be able to perform a pre-determined task or serious of tasks that you
assign to a security group.
Let's review the following rules their permissions and let us review their description of each role.
We have got CIA administrator it man.
He may he or she managers see issue and manage certificates.
This role is assigned in the certification authority.
Council user assumes this role can configure all aspects of the ACA and assign the other roles as necessary.
The next role is certification cert manager he or she issues and manages certificates.
This role is assigned in the C Council and other role is backup operator he or she backs up files and
directories restores files and directories.
This role is an operating system role that the membership in the local backup operator security group
defines they've got as well auditor he or she manages auditing and security.
This role is them operating system role that the local security policy on the C defiance and the last
role is and Raleigh's they request certificates defiant of the seeing object or in role defined on the
certificate template.
This role scene is a C a role that enables assigned users to see the C and request certificates.
It does not imply that assigned to users have permissions to enroll because that permission is assigned
on a certificate template.
By default the authenticated user a security principal has to request certificates permissions on SC.
However you might have more specific rules that assign enrollment permissions for rich unique template
that your organization requires.
Please know that the local administrators group on a C as the manager S.A. and issue and manage certificates
permissions by default on enterprise C this permissions also extend to the domain Edmonds sound enterprise
admins groups on stand alone says that are joined to the main members of the domain admins group also
have full administrative rights on the C now some votes about create security rules for a DC s administration.
You should be aware that ADC is does not automatically create the roles and groups that are listed in
the table above
when you install it this year the urls listed above are representative of a typical ADC deployment where
you desire a rule based administration rule based administration must be unique to each ADC as deployment
therefore you should plan and create only the roles that are necessary for your organization.
Let's take a look at the following scenario and think about how we could configure role based administration
to meet the requirements now.
You are the ADC yes administrator for a data corporation you have deployed a standalone route see that
is joint to the domain and to enterprise subordinate seize once subordinates a real issue user certificates
and the other subordinates they will issue computer certificates.
You want to set up a rule based administration so that you can have the following roles are always managed
see and issue and manage certificates rights on all Cs in their hierarchy are always managed C and issued
minute certificates rights on subordinates is on a roll with issue and manage certificates rights for
the user certificate template and our role with issue and manage certificate rights for the computer
a certificate template now you would configure role based ADC as administration by these following steps
you have to create a security group in a d d s that alliance to each role you want to assign in a DCF
based on the requirements above you would create the following groups for each required role you would
create enterprise PCI admins subordinate C Edmonds user of CERT managers and computer cert managers
on Step 2 on each C in hierarchy you assign the enterprise B guy admins group the manage c end issue
and manage cert permissions in the certification authority council step three would be on each subordinate
C you assign the subordinate C admins group the manage C and issue and manage certificates permissions
in the certification authority.
Council step 4 would be on the subordinate C that real issue user certificates you assign the user certificate
managers group their issue and manage certificate permissions in the certification authority council
on the certificate.
Manager step of the C properties you restrict their user certificate managers group to the user certificate
template and step 4 step 5 sorry would be on the subordinate C that will issue computer certificates
you are assigned a computer certificate managers group the issue and manage certificates permissions
in the certification authority cancel out all the certificate manager of step of the C properties you
restrict the computer certificate managers group to the computer certificate template next up we'll
be talking about configuring C policy and exit modules I'll see you there.