An access control strategy is the building block on which you can start designing your directory services structure because it determines the overall strategy that you will follow in implementing security throughout the directory. There are two strategies that you will need to strike a balance between: access and control. Access means that you would build your directory security with easy accessibility in mind, focusing more on accommodating access than tightening security. Control implies that you grant the least permissions possible and would then move on to relaxing permissions as the need arises. This approach maintains system integrity and security as its top priority.

To implement a security strategy on files, folders, and directory objects, we need to enlist the help of ACLs or access control lists, which determine who has access to resources and how much access a given user has. ACLs comprise two layers of security, NTFS security and share security. NTFS security is implemented on the actual object, whereas share security is used when this resource is accessed over the network. When the NTFS and share permissions are not the same, the most restrictive permissions apply. NTFS permissions are the ideal place to set up your permissions because it has the ability to propagate its settings to subfolders, can be backed up, are more flexible, and can be audited, whereas shared permissions lack all of these.

When analyzing risks to your directory services, you should start by examining the methods by which your system can be...