• i'll use windows authentication and create AD groups. grant access to groups not individual accounts