Re: Groups best practices

Tech-Archive recommends: Fix windows errors by optimizing your registry

From: Marin Marinov (mlmarinov_at_askme.ca)
Date: 05/13/04 

Date: Thu, 13 May 2004 13:05:34 -0400

In article <eOqJXbQOEHA.3924@TK2MSFTNGP09.phx.gbl>, nospam@nospam.nospam
says...
>
> I am trying to decide how to assign user permissions to shares on computer.
> SHould I use Global groups or put Global groups into local groups and then
> assgin the permissions.
> The second approach seems complex and cumbersome to me and would like to
> avoid it if at all possible.
>
> -SA.
I assume this computer is a domain member since you post in this
newsgroup ;) A best practice for a single domain is using the A G Dl P
strategy - put Accounts into Global groups, Global into Domain Local,
and grant Permissions at the resource to Domain Local group. It has
proven to be the most flexible in the long run. Since the machine is a
member of a Win2K or higher domain, forget about local groups for
granting access to resources - the AGLP strategy was used in NT 4.0 but
with Domain Local groups it's no longer justified.

HTH 

-- 
Cheers,
   Marin Marinov
   MCT, MCSE 2003/2000/NT4.0,
   MCSE:Security 2003/2000, MCP+I
-
This posting is provided "AS IS" with no warranties, and confers no 
rights.

Relevant Pages

  • Re: AD Groups + A,G,DL,P theory
    ... That is accounts go into global groups, global groups go into local groups and the local groups get permissions. ... Once you went to multiple domain it had quite a few holes in it as anyone who has run a large environment will tell you. ... The more practical solution is to have as few groups as possible and keep the permissions assigned as close to the resources as possible but even that is simply a guideline, it depends entirely on your structure and how you feel about doing things. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Active Directory Group Strategy
    ... in particular adding Domain Global Groups to Server Local Groups. ... I haven't read any of the literature lately, but I've always just granted permissions based on Domain Global Groups, mainly because it makes things much easier if say you want to migrate resources to different servers. ... However, in the real world what typcially happens is that someone creates a Global Security Group, makes the user account objects members of said Global Security Group and applies permissions to that GSG. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Groups best practices
    ... I am talking about domain global groups. ... groups into domain local groups and then assigning the domain local groups ... >> I am trying to decide how to assign user permissions to shares on ... > newsgroup;) A best practice for a single domain is using the A G Dl P ...
    (microsoft.public.win2000.active_directory)
  • Re: Microsoft Security Groups
    ... What would be the difference if I had a resource and ... I correct to say that when you assign global groups to local groups ... it's when you are in a multi-domain enviroment?? ...
    (microsoft.public.security)
  • Re: Global Group / Domain Local
    ... Depends on whether you're referring to share permissions, NTFS permissions, ... Global Groups go into Domain Local Groups ... Domain Local Groups are assigned Permissions. ...
    (microsoft.public.windows.server.general)