【原創翻譯】為Windows XP使用者建立“SubAdministrator”工作群組

http://techrepublic.com.com/5100-10877_11-5768233.html?tag=nl.e064

Create a 'SubAdministrator' group for Windows XP users
為Windows XP使用者建立“SubAdministrator”工作群組

by  Greg Shultz

Takeaway:
For security reasons, you should dictate which privileges certain users have when they're working in Windows XP, either in a stand-alone configuration or in a peer-to-peer network. In order to give users a broad range of system admin capabilities and restrict them from accessing all system resources, you can create a 'SubAdministrator' group. 
概述：
無論是一台獨立配置的或者處於點到點網路中的電腦，由於安全原因，你需要為使用Windows XP的使用者授權。為了給予使用者管理員級的許可權，同時限制他們訪問所有的系統資源，你可建立一個“SubAdministrator”工作群組。

Windows XP Professional provides you with a number of built-in local groups with specific privileges. When setting up stand-alone systems or systems that will participate in peer-to-peer networks, you can assign local user accounts to these groups in order to dictate how much control users have when they're working in the operating system.
Windows XP專業版為你提供一些帶有特定許可權的內建本地工作群組。當建立獨立配置的系統或者點到點網路中的系統，你可以分配本機使用者帳號到這些組中，使他們在作業系統中具有一定的許可權。

In most cases, you assign user accounts to the Users group. However, if you want to give certain users more control over the system, you can assign those accounts to the Power Users group.
大多數情況下，你分配使用者帳號到User工作群組中。然而，如果你想給可靠的使用者們更多系統控制權，你可能分配這些帳號到PowserUser工作群組中。

When the Power Users group doesn't quite provide the privileges that you want, it's very easy to simply reassign the account to the Administrators group and call it a day. However, that can be a dangerous proposition in many situations.
當PowserUser工作群組不能恰當提供你所需要的許可權時，分配帳號到Administrators工作群組是輕而易舉地，然而，這在某些條件下是危險的舉動。

A much wiser choice would be to add the user's account to the Backup Operators group, in addition to the Power Users group. The combination of privileges from both of these local groups give the user account a broad range of system administration capabilities, without giving access to all the system resources to which the Administrators group has access. You can think of the combination of these two groups as a "SubAdministrator" group.
更明智的選擇是增加使用者帳號到Backup Operators工作群組以及Power Users工作群組中。這些工作群組的許可權組合給予使用者以帳號管理員級的許可權，而未給予Administrators工作群組所能訪問的所有系統資源的許可權。你可以想象這兩個工作群組的組合為“SubAdministrator”工作群組。