Windows Server 2003 Security: A Technical Reference

Default Operating System User Roles

It is much easier to administer users on a system if the roles that a user may perform on the system are defined, and each user is provided membership in a role. It is easier because it reduces the number of different access definitions that must be managed and because it removes these definitions from the dynamics of employee changes. When roles are defined and used, it is easy to provide the required access to a new employee; he can simply be given that role. It is also simple to remove someone's access by removing him from that role. Auditors can also more easily determine if access is defined correctly (the right access is granted for each role) and assigned correctly (the right individuals are given the ...