Mission Critical Software Enterprise Administrator v4.50
Installing and configuring the EA server is no picnic. Mission Critical realizes this; its price includes an on-site visit by a Service Engineer to give you an overview of the system and help you with installation and setup. Our advice: Take the company up on this offer. However, if you decide to be brave--or foolhardy--and go it alone, you'll appreciate EA's thick, printed User's Guide, a thoughtful resource you see all too infrequently these days.

EA's innovation is to allow the primary system administrator to delegate authority with less risk. In a traditional NT environment, administrators generally delegate by giving away the administrator password and hoping that nobody makes a major mistake or goes berserk. EA controls the risk by allowing the administrator to define a territory, which indicates a set of user accounts, groups and resources in a domain. Creating territories is very easy, and once they were defined in our tests, we found it just as easy to add user accounts and other resources to them. Each territory needs a Marshal to control it. After you start up EA, it prompts you to define yourself as a Marshal if you have not yet done so. A Marshal then can create Deputies.

Each Deputy has certain control and access within a given territory. The Deputy then can perform the system administration tasks on the user accounts, groups and other resources. (The actual flow of events within EA is a little bit different--a Marshal is created before a territory--but the process is a little easier to understand in this manner.)

Now that's the general concept, but in reality the description above is the much simplified, Reader's Digest version. For instance, a Marshal can be one of three types. A Marshal Administrator is treated like a Windows Administrator within EA. He or she can create other Marshals, and can perform functions specific to certain NT groups, such as Backup Operators. The second type, called simply Marshal, has access to all powers over user accounts, groups and resources--including computers on the network, printers, services, shares, devices, open files on the server, domain controllers and domain members. The third type of Marshal is limited to the very specific powers assigned to it.

The powers that Marshals assign to Deputies are the normal NT powers that an administrator can exercise over resources. For example, a Deputy with the UserDelete power can delete user accounts and so on within the Deputy's territory, allowing you to separate powers creatively among Deputies by designing appropriate territories. The resources that belong to a territory are not limited to user accounts and groups but include shares, open files, event logs, printers, devices, domain controllers and domain members. Of course, Windows NT has some built-in delegation powers--namely, the special groups Administrators and Operators. A user who belongs to the Administrators group has more or less free reign as far as accounts are concerned. Users belonging to the Operators groups have more specific sets of functionality within a domain, depending on the group. Account Operators group members, for example, can create user accounts and modify them.

So, given NT's own capabilities, you may wonder why you'd need EA. It comes down to security: To manage complicated networks securely, you

either have to trust a large number of individuals across many computers and resources, or you have to divide your resources into domains, giving specific users powers within their respective

domains. Neither solution is viable; both create more problems than they solve. EA allows you to maintain a single-

domain model and yet be able to delegate granule powers to individuals across very specific resources. In fact, with EA you can do without the Operators Groups altogether.

One of the very first steps you should consider if you're using EA is to consolidate all your domains, with one Primary Domain Controller (PDC) and a Backup Domain Controller (BDC). Even though EA handles trusted domains well and you can use EA to administer multiple domains, the need for multiple domains disappears with the introduction of EA into your environment.