User guide

5: LDVR-SP Network Recommendations and Requirements
36 —
revision 38
Network Access Rights
In a computer network the servers must validate users and workstations before
granting them access to various resources. Access rights are controlled by one or
more servers or workstations running Windows 2000. Since every digital video
component operates in a Windows environment, access rights are granted and
revoked using standard Windows 2000 user management tools, not by programs
supplied with the digital video package.
The following windows user accounts must be valid users (not necessarily
administrators) on the LDVR-SP in order to gain access to resources:
• Windows user account used by an Alarm Monitoring user who wants to play
video
• Windows user account that the communications server (database server)
runs under
• Windows user account that video archive server runs under
• Windows user account used by System Administration user who wants to
configure the motion mask for a camera
Consider the following recommendations when managing access rights and
privileges for a network:
• By default, the LDVR-SP unit ships without using Windows Authentication.
This allows all B.A.S.I.S. Services and Users the ability to connect to and
receive updated status information, play live and recorded video without any
additional authentication outside of logging into B.A.S.I.S.. If a more robust
method of authentication id required, authentication can be used as described
below. To activate this type of Authentication you MUST register the file,
NTAuthentication.reg, located in the LDVR-SP directory on the Lenel
Digital Video Recorder.
• You should set up three types of accounts: a single privileged user account to
act as an administrator of the entire network, an operator account for
technicians that perform duties such as alarm monitoring or badge creation,
and one or more regular accounts for ordinary users. It is a good idea to
include all users' as well as the administrator's accounts into a LDV users
group to simplify management of access rights. The operator account is
usually given rights to manage the accounts of ordinary users.
• The same account creation and configuration procedure must be performed
on EVERY server or client computer running Windows 2000. This task is
tedious and time consuming for large numbers of machines. Therefore,
consider setting up a dedicated Windows 2000 Server to be a primary
domain controller of the network. As a result, all networked LDV stations
running Windows 2000 can easily become a member of the domain and
access the same user account information that is defined at the domain
controller site.
• As an added service, the same Windows 2000 Server machine may act as
DHCP and WINS server for other computers in the network to simplify their
configuration.