Re: Add custom local user to NTFS rights from GPO

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

For what it's worth, I suggest NOT using Local Groups at all. Domain groups can be directly applied in NTFS permissions.

A big reason for avoiding Local Groups is that there is no central way to find out which domain user accounts and domain groups are members of a local group (or directly including in a permission list either).

I suggest define a Domain group specifically for the permission set (e.g. Modify) to be applied to the resource (e.g. folder) and use that Domain group only for setting permissions on that resource. Then, populate the Domain group with domain user accounts or domain groups as appropriate. Then, you can find out using Active Directory Users and Computers which groups and thus user accounts have the granted permission on the resource. It also allows you to do the inverse - for a given user account find out what permissions they have to what no matter which computer the resource is on.

With Windows NT 4, group nesting was very limited and using Local Groups was required. With Windows 2000 and later, you only need to use Local Groups is if you are using local user accounts for some particular reason and the built-in Local Groups (e.g. Users, Power Users) are not adequate for the purpose.

--
Bruce Sanderson MVP Printing
http://members.shaw.ca/bsanders

It is perfectly useless to know the right answer to the wrong question.



"fpbear" <dontsendhere@xxxxxxxxxx> wrote in message news:u9M%23DJGfHHA.596@xxxxxxxxxxxxxxxxxxxxxxx
I thought it would be possible to specify a generic custom local group when setting the NTFS rights in the File System section of the GPO. But when I type in the object it always resolves to the SID, i.e. it first checks to see that the object exists on a domain or target machine. I thought I could just do this by typing in a name and let the text string resolve during client processing of the GPO.

This method can be used with User Rights Assignment. You can just type in the name of a custom local group and it will match the display name during client processing of the GPO. There is no need to resolve to the SID with User Rights Assignment.

We need to do this because we would like to put all of the special NTFS permissions in the GPO, but the problem is that we are adding custom local group. It wouldn't make sense to browse to the target client machine and let it resolve as a SID because the custom local group will have a different SID on each target workstation.

Otherwise we'd have to set the NTFS lockdowns using the application's installer, but this doesn't make it as visible for security auditing purposes.


.

Relevant Pages

  • Re: Unable to see domain from XP Pro client
    ... >when I try to add domain groups to local groups, I cannot see the domain - ... Is the domain properly setup so the workstations can access the ...
    (microsoft.public.windowsxp.network_web)
  • Re: Add custom local user to NTFS rights from GPO
    ... We ended up going with Local Groups because these custom groups are used by ... Local Groups during the install, so internally it knows the SIDs. ... Restricted Groups are used to automatically nest the Domain Groups under the ... The limitation is now we can't define the NTFS permissions via GPO, ...
    (microsoft.public.windows.group_policy)
  • Re: Local vs. Domain Local Groups?
    ... Using Local Groups is a way of achieving security isolation. ... user can add domain groups to the local groups. ... to each individual computer to modify the group membership. ...
    (microsoft.public.windows.server.active_directory)
  • Why No Local Group In Local Groups?
    ... Why is it that Local groups on Windows 200x cannot nest other Local groups, ... but can nest local users, domain groups, and domain users? ...
    (microsoft.public.windows.file_system)
  • Local user groups, how to assign users to Power Users grp?
    ... I want to be able to asign users to local groups, ... In computer management (admin account), I did this and it confirms that I ... but when I logged into one of the new "power user" ... In checking the user accounts in the CP for that user, ...
    (microsoft.public.windows.mediacenter)