三叉戟

领域专家的成长记录

用户工具

站点工具


resources:tools:gws_baseline

**这是本文档旧的修订版!**

1.Directory

1.1 Users

1.1.1 Ensure more than one Super Admin account exists

From a security point of view, having only a single Super Admin Account can be problematic if this user were unavailable for an extended period of time. Also, Super Admin accounts should never be shared amongst multiple users.
To verify this setting via the Google Workspace Admin Console:

  1. Log in to https://admin.google.com as an administrator
  2. Go to Directory and click on Users, this will show a list of all users
  3. Click on + Add a filter, select Admin role, check the Super admin box, and then select Apply
  4. The list of Users displayed will only be those with the Super Admin role
  5. Make sure more than one (1) user is listed

### 1.1.2 Ensure no more than 4 Super Admin accounts exist
From a security point of view, having a large number of Super Admin accounts is a bad practice. In general, all users should be assigned the least privileges needed to do their job. This includes Administrators since not everyone that needs to “Administer Something” needs to be a Super Admin. Google Workspaces provides many predefined Administration Roles and also allows the creation of Custom Roles with very granular permission selection.

Ensure super admin accounts are used only for super admin activities

Use the super admin account only when needed. Delegate administrator tasks to user accounts with limited admin roles. Use the least privilege approach, where each user has access to the resources and tools needed for their typical tasks. For example, you could grant an admin permissions to create user accounts and reset passwords, but not let them delete user accounts.
To verify this setting via the Google Workspace Admin Console:

  1. Log in to https://admin.google.com as an administrator
  2. Go to Directory and click on Users, this will show a list of all users
  3. Click on + Add a filter, select Admin role, check the Super admin box, and then select Apply
  4. The list of Users displayed will only be those with the Super Admin role
  5. Click on + Add a filter, select Admin role, check the Delegated admin box, and then select Apply
  6. Verify that there are no users in both the Super admin and Delegated admin roles

For every Super admin that is also a Delegated admin account, either create a Delegated admin account for the user of elevate or their existing non-admin account to a Delegated admin account.

resources/tools/gws_baseline.1733494637.txt.gz · 最后更改: 2024/12/06 23:17 由 jackiez