Microsoft® Windows® Security Resource Kit, Second Edition

Best Practices

• Use least privilege. Whenever assigning permissions, assign the least privilege the user needs to complete her job function.

• Assign permissions at the highest possible point in a hierarchy. Always assign permissions at the highest point in the container hierarchy and allow them to be inherited by child objects to simplify their application.

• Assign permissions to security groups, not users. Assigning permission to security groups by using a structured model makes assigning permissions scalable and flexible. This is helpful when users and files change.

• Use caution when encrypting files. Always archive the DRA when encrypting files with EFS to prevent files from being irreversibly encrypted.