Planning and Implementing an Authorization Solution

An Overview on Authorization

Authentication is the first step in implementing a security strategy to protect your network resources and elements from unauthorized users, because it is the process that deals with identifying valid authorized network users from unauthorized users. Authentication therefore verifies the identity of users. The next step in securing your network resources and elements from unauthorized access is authorization. Authorization is the process that controls which objects an authenticated network user can access. Just because a user is authenticated, does not necessarily mean that the particular user is permitted to access all network resources. Authorization determines whether the user can indeed access, and perform the requested actions on the network resources, which the user is attempting to access.

Access to network resources is controlled by setting permissions for objects, and assigning rights to users. Permissions define the users, or groups which are permitted to access the network resource. Permissions also detail the type of access permitted to a particular network resource. Access to a network resource is controlled by the owner of that particular resource or object.

An effective authorization strategy should limit the access which a user needs to only those network resources which the particular user needs to accesses, to perform its daily duties. You can therefore also think of authorization as the process of differentiating between standard users, administrators, and guests. Individually assigning rights to users could become impractical in a large organization. Implementing groups and then assigning rights to groups is a more feasible solution. Groups facilitate simpler access management processes.

Authorization practically occurs each time that a user who has passed authentication, attempts to access the following objects or network resources:

Because of the diverse number of object types that typically exists in a network environment, Windows Server 2003 attempts to simplify authorization management tasks. Assigning permissions to each particular object type could become a cumbersome task. Windows Server 2003 utilizes a standard authorization model or strategy for all types of network objects. The interface used to configure permissions for each type of object is very much the same as well. The standard authorization model utilizes the following components to implement authorization:

Understanding Access Control Lists (ACLs)

ACLs hold information on the users or groups which are allowed or denied access to a particular object. What this means is that the ACL identifies those users who can access a particular resource. The ACL of an object is managed by the owner or creator of that particular object. An ACL contains access control entries (ACEs). The ACE is an entry in the ACL of an object which grants permissions to users/groups to access the object. A user is granted access to an object, if an ACL explicitly identifies the particular user, or if it explicitly identifies a group to which the particular user is a member of. Similarly, the user is denied access to the object when the ACL does not explicitly identify the user, or any group to which the user is a member of.

Access control lists (ACLs) consists of the following sets of permissions:

Understanding Standard Permissions and Special Permissions

When you configure the access control lists for the different object types, you can use standard permissions and special permissions.

The standard and special permissions which can be applied to files and folders are listed in the following section

How to view, configure, or change special permissions for files and folders

  1. Open Windows Explorer
  2. Locate, and right-click the file or folder, and then select Properties from the shortcut menu.
  3. When the Properties dialog box of the file or folder opens, click the Security tab.
  4. Click the Advanced button
    • If you want to configure a special permission for a user/group, click Add, and then enter the name of the user/group in the Name box. Click OK
    • If you want to view or change the special permissions for a user/group, select the user/group, and then click the View or Edit.
    • If you want to remove a user/group, and any associated special permissions, simply select the user/group, and then click Remove.
  5. If you are working with a folder, specify where the permission should be applied in Apply Onto, on the Permission Entry dialog box.
  6. Specify the Allow or Deny for each particular permission
  7. Click OK.

The standard permissions which can be applied to shares are summarized below.

How to set share permissions

  1. Open the File Server Management console.
  2. Select Shared Folder, and then access the Shares subfolder.
  3. Locate and right-click the shared folder that you want to set permissions for, and select Properties from the shortcut menu.
  4. Click the Share Permissions tab.
  5. Specify the appropriate share permissions.
  6. Click OK.

The standard and special permissions which can be applied to Active Directory objects are listed in the following section.

How to assign standard permissions for an Active Directory object

  1. Click Start, Administrative Tools, and Active Directory Users And Computers.
  2. Advanced Features should be enabled. Verify this on the View menu.
  3. Locate and right-click the Active Directory object which you want to assign permissions for, and click Properties on the shortcut menu.
  4. When the Properties dialog box of the object opens, click the Security tab.
  5. Click Add.
  6. When the Select Users, Computers, Or Groups dialog box opens, enter the name of the user/group for which you want to configure permissions. Click OK.
  7. Use the Allow and Deny checkboxes to add, change or deny permissions.
  8. Click OK.

The standard and special permissions which can be applied to printers are summarized below.

How to change the standard permissions configured on a printer

  1. On the Start menu, access the Printers and Faxes folder.
  2. Right-click the printer for which you want to change standard permissions, and click Properties from the shortcut menu.
  3. In the Properties dialog box of the printer, click the Security tab
    • If you want to add a user/group to the list of users assigned permissions to the printer, click Add, and enter the name of the user/group.
    • If you want to modify the current permissions for a user/group, select the user/group, and then specify the permissions for the particular user/group.
    • If you want remove a user/group, select the user/group, and then click Remove
  4. Click OK

The standard and special permissions which can be applied to services are summarized below.

The standard and special permissions which can be applied to registry keys and values are summarized below.

Understanding Explicit Permissions, Inherited Permissions and Effective Permissions

Permissions that are directly set for an objects such as folders, files, or Active Directory objects are called explicit permissions. In an effort to ease the administrative tasks necessary to assign permissions, inherited permissions are used. Inherited permissions enable permissions to be propagated from a parent object to child objects. The default configuration for inherited permissions is that all newly created child objects automatically obtain the permissions specified on its associated parent object. You can stop a child object from inheriting the permissions of a parent object by clearing the Allow Inheritable Permissions From The Parent To Propagate To This Object And All Child Objects checkbox.

Because users can be assigned permissions from different sources, the actual permission effect is considered cumulative. Another way of saying this is that the permissions which are granted to a user or group are cumulative. Individual user permissions can be either the allowed permission or the denied permission for resource access. In addition to this, a user can be a member of many different groups. Groups can also be nested within other groups. When determining the effective permissions of a user, all the above has to be considered, while bearing in mind that any denied permissions always override allowed permissions. This includes inherited permissions.

Deciding on the appropriate ACL access method to implement for controlling access to resources

If you are dealing with a small organization that has roughly ten users or less, you can implement the User/ACL method to control access to resources. This method only tends to work optimally in small organizations that only need a small number of groups to manage resource access. In large organizations, the User/ACL method has the following shortcomings:

With the Account Group/ACL method for controlling access to resources, the global group in which users are placed, is added to the ACL. What this means is that permissions to resources is assigned on a per group basis. Using groups, you can configure the same permissions for all users in the group that need to access the resources. This in turn leads to simpler management. Global groups can also be added to the ACLs of any trusted domains. The Account Group/ACL method also has a few limitations. These are detailed below.

With the Account Group/Resource Group method of controlling access to resources, users which have similar access requirements to resources are added to an account group. The Account Group/Resource Group method is the most feasible method to control access to resources in large organizations. The Account Group/Resource Group method has the following benefits:

Deciding on the appropriate Group strategy to implement for accessing resources

Groups assist in managing users, computers, and other objects; and in controlling access to network objects or resources. The group scopes available in Windows Server 2003 are briefly listed below.

The strategy which Microsoft recommends for implementing a permission structure to control access to resources is called AGDLP. This consists of the following steps:

  1. Add domain users to global groups.
  2. Add global groups to domain local groups.
  3. Assign the domain local groups the permissions on the particular resource(s).

When including Universal groups, the permission structure is known as AGUDLP.

  1. Add domain users to global groups.
  2. Add global groups to universal groups.
  3. Add universal groups to domain local groups.
  4. Assign the domain local groups the permissions on the particular resource(s).

A few key factors to remember when nesting or combining groups are summarized below. While nesting or combining groups can indeed significantly reduce network traffic and the administrative overhead necessary to manage access to resources, you have to take time to plan the group nesting strategy which you want to implement in your environment.

How to troubleshoot authorization problems

Troubleshooting simple authorization issues typically involves the following process.

  1. Determine the effective permissions of the user for the particular object.
  2. Examine the effective permissions, and then assign the user or the group to which the user belongs; the necessary permissions to perform the required tasks.

To determine the effective permissions of a user,

  1. Examine the permissions of the particular object.
  2. Select the Advanced button.
  3. When the Advanced Security Settings dialog box opens, click the Effective Permissions tab.
  4. Click Select, and in the Select User, Computer, Or Group dialog box, enter the user’s name for which you want to determine effective permissions. Click OK.
  5. Proceed to examine the permissions that the user has, and compare this to the permissions that the user requires. Click OK
  6. You can now assign any other necessary permission to the user.

For complex authorization problems, where it is more complicated to determine whether an application is attempting to access an Active Directory object, service, file, or registry value; you can enable and use failure auditing to determine which objects the application or user is unsuccessfully trying to access.

To enable failure auditing,

  1. Log on to the appropriate system or domain controller.
  2. Click Start, Administrative Tools.
  3. If you are logged on to a member server, or standalone server, click Local Security Policy.
  4. If you are logged on to a domain controller, click Domain Controller Security Policy.
  5. Proceed to expand Local Policies. Click Audit Policy.
  6. For Active Directory object access problems, double-click Audit Directory Service Access.
  7. For other object types, double-click Audit Object Access.
  8. Record the existing settings so that you can reconfigure them after you have troubleshooted the authorization problem at hand.
  9. Select Define These Policy Settings, and select Failure.
  10. Click OK.

Now that you have enabled failure auditing for either the Audit Directory Services Access policy or the Audit Object Access policy, the following step in troubleshooting the authorization problem is to enable auditing for the particular resource(s).

You can enable auditing for the files and folders object type by using the following steps:

  1. Open Windows Explorer
  2. Locate and right-click the file or folder which you want to enable auditing for, and then select Properties from the shortcut menu.
  3. When the Properties dialog box of the file/folder opens, click the Security tab, and then click Advanced.
  4. Click the Auditing tab.
  5. Record the current auditing settings, so that you can reconfigure them after you have completed troubleshooting the authorization problem.
  6. Click Add
  7. Enter the name of the particular user experiencing the problem in the Select User Or Group dialog box. Click OK.
  8. When the Auditing Entry dialog box appears, click the Failed checkbox for Full Control. This automatically checks all other Failed checkboxes. Click OK.
  9. An event will now be logged in the Security event log whenever the particular user is denied access to the resource.
  10. You can analyze these failure events using Event Viewer.


Top 5 Free Networking Tools

Bookmark Planning and Implementing an Authorization Solution

Latest Blog Posts


English English GermanGerman SpanishSpanish FrenchFrench ItalianItalian PortuguesePortuguese RussianRussian DutchDutch
GreekGreek HindiHindi JapaneseJapanese KoreanKorean ChineseChinese Chinese (Simplified)Chinese (Simplified) ArabicArabic

Copyright 2009 Tech-FAQ. All rights reserved. Privacy Policy.