1. 1 Module 4 Setting Up Group Accounts

2. 2  Overview Introduction to Groups Planning a Group Strategy Creating Local and Global Groups Implementing Built-in Groups Best Practices

3. 3  Introduction to Groups Groups Are Collections of User Accounts Group Members Get All Group Permissions and Rights Local Groups Provide Access to Resources and Rights to Perform System Tasks Global Groups Organize Users Resources Global Group “Sales” Global Group “Sales” PermissionsPermissions Local Group “Resources” Local Group “Resources”

4. 4 Local and Global Groups Summary Local Groups Provide users with permissions or rights Can include (from any domain): User accounts Global groups Can include (from any domain): User accounts Global groups Cannot include other local groups Are assigned permissions and rights in the local domain On Windows NT Workstation or member server, can only be assigned to local resources On a PDC, can be assigned resources on any domain controller in the domain Organize domain users Global Groups Can only include user accounts in the domain where it resides Cannot contain local or global groups Are added to a local group to give its members rights Are not assigned to local resources Must be created on a PDC in the domain where the accounts reside

5. 5 Planning a Group Strategy Logically Organize Users Based on Common Needs Create Global Groups and Add User Accounts Create Local Groups Based on Resource Access Needs Assign Permissions to Local Groups Add Global Groups to Local Groups

6. 6  Creating Local and Global Groups You Must Be a Member of Administrators or Account Operators Group You Can Create Local Groups on Any Windows NT Computer You Create Global Groups on a PDC from Any Computer Running User Manager for Domains Group Names Must Be Unique to the Domain User Manager - DOMAIN1 UserViewPoliciesOptionsHelp User New User... New Global Group... New Local Group... Copy...F8 DeleteDel Rename... Properties...Enter Select Users... Select Domain Exit New Global Group...

7. 7 Creating Global Groups New Global Group Quebec Group Name: Description: Quebec domain users OK Cancel Help Members: Eric BlondelEric < - Add Remove - > Not Members: Account adminstra Acctman Linda KoboraLinda Sandy AltoSandy Ryan CalafatoRyan Kathryn YusiKathryn Susan StevensonSusan Rick WallaceRick Administrator Account adminstraAcctman

8. 8 Creating Local Groups New Local Group Sales Group Name: Description: Show Full Names Add... Remove Members: StefanH OK Cancel Help Sales Personnel Add Users and Groups Names: List Names From: AdministratorsMembers can fully administer the comput Account OperatorsMembers can administer domain user an CancelOKHelp Backup OperatorsMembers can bypass file security to bac Domain AdminsDesignated administrators for the domain Domain GuestsAll domains guests EveryoneAll Users GuestsUsers granted guest access to the comp Type of Access: CLASSROOM\Domain Users Show Users Add Members... Search... Add Names: CLASSROOM* Read Domain UsersAll domains users DomainsDomains

9. 9 Deleting Groups New User... New Global Group... New Local Group... Copy...F8 DeleteDel Rename... Properties...Enter Select Users... Select Domain Exit DeleteDel User Manager - DOMAIN_A UserViewPoliciesOptionsHelp User Deleting a Group: Permanently removes permissions and rights associated with it Does not delete the member user accounts

10. 10  Implementing Built-in Groups Built-in Local Groups Give users rights to perform system tasks Built-in Global Groups Give administrators a way of controlling domain resources System Groups Organize users for system use Membership is automatic and cannot be modified User Rights Policy Show Advanced User Rights Computer:User-1 Cancel OK Help Add... Remove Grant to: Everyone Power Users Administrators Right: Access this computer from network

11. 11 Built-in Groups on All Windows NT Computers UsersUsers Ordinary users AdministratorsAdministrators Administrator GuestsGuests Guest BackupOperatorsBackupOperators No members Power Users No members Windows NT Server Domain Controller Windows NT Server Domain Controller Windows NT Server Member Server Windows NT Server Member Server Windows NT Workstation

12. 12 Built-in Groups on Domain Controllers Only Domain Controller Local Groups Account Operators Account Operators Printer Operators Printer Operators Server Operators Server Operators Global Groups UsersUsers Domain Users AdministratorsAdministrators Domain Admins GuestsGuests Domain Guests Domain Users Domain Users Domain Guests Domain Guests Domain Admins Domain Admins

13. 13 Built-in System Groups Reside on All Computers Membership Cannot Be Modified Users Become Members Automatically During Network Activity Two Key System Groups Everyone Creator Owner

14. 14 Best Practices Add Users to Built-in Groups that Are Most Restrictive Add Domain Admins from Other Domains to Local Administrators Assign Rights to Users Only If Built-in Groups Don’t Meet Your Needs Use Domain Users Instead of Everyone (Medium and High Security)

15. 15 Review Introduction to Groups Planning a Group Strategy Creating Local and Global Groups Implementing Built-in Groups Best Practices