Instead, assign each user to a group in your domain, and assign file and folder access rights to members of the group. You can learn a great deal from browsing a server's registry, so you should assign ACLs to Registry keys as well as to NTFS folders and files. Use the regedt32 graphical tool to assign access rights to Registry keys. If only administrators are allowed to log into servers, you can safely permit write access only to members of administrative groups and to the System account, under which many services run. Microsoft details the steps needed to restrict or disable remote registry access on its Web site.
Passwords are another area to be concerned with.
Shoulder surfers can watch employees enter short passwords, and most people, left to their own devices, will assign passwords that can readily be guessed. You can configure password policy in NT 4.0 with the User Manager for Domains tool. To mitigate password-related security problems, expire passwords periodically, so that all users must select new ones. In addition, require a minimum password length of six characters, as longer passwords are harder to guess. Users typically have a handful of favorite passwords that they assign in rotation.