If you are using Windows authentication, then security is handled by Active Directory. You create users and then add them to Groups, and assign the permissions to the groups...