Re: NTFS... Group Nesting...

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

Thank you for uyour answer, but could i use the same stratgey on
a system where domain local/gloabl didint matter.

Becauase all accounts are on the same domain and are accessing resource on
the same domain?

Robert

"Laura E. Hunter [MVP]" wrote:

Create a Domain Local Group and assign share permissions to that Group.

Create a Global Group containing your "Secured Users"

Add both the "Secured Users" group and the Domain Admins group to the Domain
Local Group.

Your book probably refers to this as "AGDLP":

Add Accounts to Global groups
Add Global groups to Domain Local groups
Assign Domain Local groups Permissions to resources



<RobertBollinger@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:35186A42-A5BE-47D4-AA26-95B8F65C96CB@xxxxxxxxxxxxxxxx
I want to do this:

Allow the domain admins group access to a share that it is not permitted
to
access. using. (ACL/ACE entries)

Can i add the domain admins group to the group (say SecuredUsers) so that
the domain admins group can access a folder that only the (SecureUsres)
have
access
to, Without also granting the secured users group access to the domain
admins resources (such as admin only shares).

I understand how to set this up, by adding the domain admins group to the
resource itself... but i dont want to do it that way.

I basically want permisisons to cross groups using Group Nesting...

I know that what i ahev said sounds stupid and confiuisng but its covered
in
my 70-290 book and i dont know how to do it.

Please Advise...

Robert




.

Relevant Pages

  • Re: NTFS... Group Nesting...
    ... Add both the "Secured Users" group and the Domain Admins group to the Domain ... Add Global groups to Domain Local groups ... Assign Domain Local groups Permissions to resources ...
    (microsoft.public.windows.server.general)
  • Re: DST has screwed up Send As
    ... or splitting up your accounts by having user accounts and admin ... in in Exchange Server ... members of the domain admins group. ...
    (microsoft.public.exchange.admin)
  • Re: Urgent - Stop shutdown command from shuting down domain statio
    ... > use the privacy of financial records laws, ... define accounts (not necessarily members of either the ... > Administrators group or the Domain Admins group) that have delegated ... > is an essential part of a strategy for securing the environment and for ...
    (microsoft.public.win2000.security)
  • Re: Active Directory Structure
    ... Do you mean the acounts of users who are members of the Domain Admins group? ... these accounts they need to be in the same OU as the one the policy is ... > Do domain controllers accounts have to be located in the domain ...
    (microsoft.public.win2000.networking)
  • security
    ... hi Folks, ... I am getting all my accounts that are in the domain admins group locked ... I get failed login audits and it locks the account ...
    (microsoft.public.security)