Access control.
WHAT AN ACCOUNT IS
An identity with its own settings, files and permissions.
WHAT A GROUP IS
A collection of accounts, so permissions are assigned once rather than repeatedly.
WHY GROUPS MATTER
Assigning permissions per person becomes unmanageable, and is never cleaned up.
WHAT PERMISSIONS CONTROL
Reading, writing, executing and modifying.
WHAT THE PRINCIPLE IS
The minimum access required for the role.
WHAT ADMINISTRATIVE RIGHTS ALLOW
Installing software, changing system settings, accessing other accounts' data.
WHY DAILY WORK SHOULD NOT USE THEM
Anything that runs inherits the privilege of the account running it.
WHAT INHERITANCE MEANS
Permissions applied to a folder flowing to what it contains.
WHY THAT CAUSES CONFUSION
Changes higher up affect items below, sometimes unexpectedly.
WHAT TO CHECK WHEN ACCESS FAILS
Which account Which group memberships What permissions apply at that location Whether inheritance is involved
WHAT TO DO AT DEPARTURE
Disable the account promptly, and record what it had.
