Creating groups

A group in Windows is a collection of user accounts. The benefit of using groups when managing access to resources is that you don't need to assign the same permissions multiple times - you assign the permission to the group, and anyone who is a member of the group receives the permission.

Like user accounts, Windows offers a number of built-in groups. A built-in group has predefined capabilities within Windows. For example, printer operators can manage all printers on the system, and anyone who is a member of the printer operators group will have that capability. The following is a list of some of the popular built-in groups found in Windows 2000/XP/2003:

• Administrators: This group has full access to the system and can change any setting on the system. The administrator account is a member of this group by default, which is why the administrator account is allowed to change any setting on the system.
• Backup Operators: Members of this group are allowed to perform backups and restores on the system.
• Account Operators: Members of this group are allowed to create user accounts. This group is available on the server versions of Windows 2000 and Windows 2003. The benefit of using this group is that if you want someone to be able to manage user accounts, you can place that person in this group instead of in the administrators group and he or she will only be able to manage the user accounts - not the entire system.
• Printer Operators: Members of this group can change any settings on the printers. Essentially, members of this group are trained to troubleshoot the printing environment and then assigned the task of managing all printing problems on the network.
• Users: All user accounts that are created are members of the users group. You can assign permissions to the users group knowing that all users will get the permission.
• Power Users: The power users group is the group on Windows 2000 Professional and Windows XP Professional that allows its users to create user accounts and manage the printing environment. Use this group if the desktop operating system does not have an account operator or a printer operator group.

If the built-in groups do not satisfy your needs, you can create your own groups as well. To create your own groups in Windows XP, follow these steps:

1. Click Start and then right-click on My Computer and choose Manage. The Computer Management console starts.
2. In Computer Management, expand Local Users and Groups.
3. Right-click the Groups folder in Local Users and Groups and then choose New Group. The New Group dialog box appears.
4. Type the name you wish to use for the group.
5. Fill in a description for the group in the Description text box.
6. To begin adding members to the group, click the Add button. The Select Users dialog box appears.
7. Type the name of the user account you want to add and click the Check Name button on the right side.
   Windows should underline the account name, indicating that the user account does exist and that you can add it to the group membership.
8. Repeat Step 7 for each account you want to add to the group.
9. After you have added all the accounts to the group, click OK and then click Create to create the group.

Now that you have created the users and placed them into their appropriate groups, you are now ready to assign them permissions.