【原创翻译】为Windows XP用户创建“SubAdministrator”工作组

http://techrepublic.com.com/5100-10877_11-5768233.html?tag=nl.e064

Create a 'SubAdministrator' group for Windows XP users
为Windows XP用户创建“SubAdministrator”工作组

by  Greg Shultz

Takeaway:
For security reasons, you should dictate which privileges certain users have when they're working in Windows XP, either in a stand-alone configuration or in a peer-to-peer network. In order to give users a broad range of system admin capabilities and restrict them from accessing all system resources, you can create a 'SubAdministrator' group. 
概述：
无论是一台独立配置的或者处于点到点网络中的电脑，由于安全原因，你需要为使用Windows XP的用户授权。为了给予用户管理员级的权限，同时限制他们访问所有的系统资源，你可创建一个“SubAdministrator”工作组。

Windows XP Professional provides you with a number of built-in local groups with specific privileges. When setting up stand-alone systems or systems that will participate in peer-to-peer networks, you can assign local user accounts to these groups in order to dictate how much control users have when they're working in the operating system.
Windows XP专业版为你提供一些带有特定权限的内置本地工作组。当建立独立配置的系统或者点到点网络中的系统，你可以分配本地用户帐号到这些组中，使他们在操作系统中具有一定的权限。

In most cases, you assign user accounts to the Users group. However, if you want to give certain users more control over the system, you can assign those accounts to the Power Users group.
大多数情况下，你分配用户帐号到User工作组中。然而，如果你想给可靠的用户们更多系统控制权，你可能分配这些帐号到PowserUser工作组中。

When the Power Users group doesn't quite provide the privileges that you want, it's very easy to simply reassign the account to the Administrators group and call it a day. However, that can be a dangerous proposition in many situations.
当PowserUser工作组不能恰当提供你所需要的权限时，分配帐号到Administrators工作组是轻而易举地，然而，这在某些条件下是危险的举动。

A much wiser choice would be to add the user's account to the Backup Operators group, in addition to the Power Users group. The combination of privileges from both of these local groups give the user account a broad range of system administration capabilities, without giving access to all the system resources to which the Administrators group has access. You can think of the combination of these two groups as a "SubAdministrator" group.
更明智的选择是增加用户帐号到Backup Operators工作组以及Power Users工作组中。这些工作组的权限组合给予用户以帐号管理员级的权限，而未给予Administrators工作组所能访问的所有系统资源的权限。你可以想象这两个工作组的组合为“SubAdministrator”工作组。