Implementing a group security policy can reduce a company's technical support staff's time in resolving support related issues. A group security policy should include the following:
- Restricting changes that can be made to the Internet Explorer configuration. This prevents users from manipulating restricted site settings or adjusting security-access levels.
- Preventing users from making changes to the network configuration. A group policy that covers this area limits users from adding share access to their hard drives, reducing the risk of exposing the company's network if file sharing is enabled when browsing the Internet.
- Preventing users from adding and removing services. If this is not controlled, you could not keep track of "plugging the hole" in vulnerable areas of the network operating system. This obviously increases the risk of an attack.
Note that when implementing a group security policy, all users should not have the same level of policy structure. Categorize users in different groups and the group security policy applied to these respective groups applies to the members of the group. For example, the Help Desk group, which will consist of personnel with technical skills, may have a policy that allows them to access users' workstations to resolve problems remotely but within the company network. However, this same group should not access confidential files stored in network servers or senior department members' hard drives.
Also look at mobile devices, such as notebooks, Palm devices, etc. when applying group policies. Group policies for these users should limit them to e-mail and updating of files stored on the network servers, depending on which server they are authorized to access.
Adesh Rampat has 10 years of experience with network and IT administration. He is a member of the Association of Internet Professionals, the Institute for Network Professionals and the International Webmasters Association. He has also lectured extensively on a variety of topics.
