Person Account
User accounts in Active Directory can only be created by ITS automatic provisioning infrastructure or by the Identity and Access Management Group.
NetID Accounts
Personal NetID accounts are systematically created by ITS and stored in the Organizational Unit (OU) called People in both Active Directory and 389. These accounts are not allowed to be moved out of their assigned OU by any person or service other than ITS' Identity and Access Management System. Nor does ITS allow departments to apply policies to these objects.
The use of NetID accounts is limited to non-privileged user activities such as accessing email, file shares, web browsers, workstations, and nonprivileged access application access. These accounts will not be granted administrative privileges on hosts or used to authenticate services or applications to Active Directory.
Privileged Accounts
All users who have elevated access to a system or service will have a secondary account used solely for tasks that require greater administrative access. These accounts will be created and maintained in the OU Admin in Active Directory and can only be acted on by Domain Admins. In 389 these accounts are stored in the OU People and access is restricted to System Admins.
...
(Can a user have two admin accounts..i.e. user moves department.. new a_ would help to remove questions about what access was manitained)
Vendor Account
A vendor account can be requested for a vendor only after a contract is in place. The account will follow the naming convention as established in the Privileged Access Standard and is limited to non-privileged user activities such as using the University VPN. These accounts will be created and maintained in the OU Generic in Active Directory, and in People for 389.
...
(Should we put specific password requirements on these accounts?)
Non-personal Accounts
A non-personal account is created for a service, application or a group to gain access. The manager/owner? of the account is responsible for the use of the account and (wording about renewals, expirations, etc).
Service Accounts
Service accounts are accounts that are designated for use for a particular service or application and have elevated privileges. A service account will be created for each function for a particular service or application, and should only be used for that purpose. The account should abide by the rules of least privilege as described by NIST. These accounts will be created and maintained in the OU Admin in Active Directory and can only be acted on by Domain Admins. In 389 these accounts are to be stored in the OU People.
...
(Should we put specific password requirements on these accounts?)
Departmental Accounts
A departmental account is an account that is shared by a group to access department resources.
...
(Should we put specific password requirements on these accounts?)
Generic Accounts
A generic account is an account sponsored by an active University faculty or staff member and used by an individual not formally affiliated with the University.
...
Generic accounts will not be granted administrative privileges to any system and should not be used to authenticate services or applications to Active Directory.
Event Access Accounts
An event access account is an account that is shared by a group to access department resources for a short predefined period of time.
...