Working with Groups

Groups are used to logically organize users with similar rights requirements. Groups simplify administration because you can manage a few groups rather than many user accounts. For the same reason, groups simplify troubleshooting. Users can belong to as many groups as needed, so it's not difficult to put users into groups that make sense for your organization.

For example, suppose Jane is hired as a data analyst to join the four other data analysts who work for your company. You sit down with Jane and create an account for her, assigning her the network permissions for the access you think she needs. Later, however, you find that the four other data analysts (who have similar job functions) sometimes have network access Jane doesn't have, and sometimes she has access they don't have. This is happening because all their permissions were assigned individually and months apart.

To avoid such problems and reduce your administrative workload, you can assign all the company's data analysts to a group and then assign the appropriate permissions to that group. Then, as data analysts join or leave the department, you can simply add them to or remove them from the group.

You can create new groups for your users, and you can use the Windows 7 default local built-in groups that were described in the previous section. In both cases, your planning should include checking to see if an existing local group meets your requirements before you decide to create a new group.

For example, if all the users need to access a particular application, it makes sense to use the default Users group rather than creating a new group and adding all the users to that group. To work with groups, you can use the Local Users and Groups utility. Let's see how to create new groups.