1. Chapter 7: WORKING WITH GROUPS
Course 290:
Chapter 7: WORKING WITH GROUPS

2. Assigning Permissions in Server 2003
For users to be able to access resources on an Active Directory network, they must have the appropriate permissions.
Shared folders and drives, printers, and virtually all other resources on a network have an access control list (ACL).
An ACL is a list of objects that are permitted to access the resource, along with the degree of access that each object is permitted.
The objects in an ACL are referred to as security principals

3. Using Groups for permissions
A group is simply a list of users that functions as a security principal.
In Active Directory, group objects can contain user objects, computers, contacts, and, under certain conditions, even other groups.
When you use a group object as a security principal by adding it to an ACL, all of the group’s members receive the permissions that you assigned to the group

4. UNDERSTANDING GROUPS

5. User Rights
Groups also make it possible to assign user rights to multiple users at once.
In Windows Server 2003, rights are distinctly different from permissions.
A user right grants a user or group the ability to perform a particular system task, such as access the computer from the network, change the system time, or take ownership of files and other objects.

6. Groups vs. Group Policies
The structure of the Active Directory hierarchy is a critical part of the domain user account creation process because rights and permissions granted to a container object are inherited by the objects they contain, including user objects
Group inheritance works the same: the members receive the settings assigned to the group.
The main difference between a group and a container is that the group is not restricted by the structure of the Active Directory tree.
You can create groups with members anywhere in the domain, and even in other domains, and grant them all privileges in one quick step.

7. GROUP POLICIES Group policies and groups are not related.
Group policies cannot be directly applied to a group.
A Group policy can only be applied to an Active Directory site, domain, or OU

8. DOMAIN FUNCTIONAL LEVELS
The Domain Functional Level determines the level of functionality used by Active Directory
The different versions of Windows have slightly different capabilities built into their Active Directory implementations.
Each successive version has some new features that are not usable when some of the domain controllers in a domain are running older versions of Windows
Changing the domain functional level informs the operating system that all of the domain controllers are compatible and that it is safe to activate the version-specific features
The Functional level can be raised but not lowered

9. DOMAIN FUNCTIONAL LEVELS
Windows 2000 mixed
default functional level of a domain controller
Supports universal distribution groups but not universal security groups
Global groups cannot have other groups as members (group nesting).
Windows 2000 native
Supports Server 2000 and 2003
Supports universal security and distribution groups.
Allows groups to be members of other groups.
Allows conversions between security groups and distribution groups.
Windows Server 2003 interim
Used only when upgrading domain controllers in Windows NT 4 domains to Windows Server 2003 domain controllers.
Windows Server 2003
Same as Server 2000 native, but only supports Server 2003

10. Managing the Functional Domain Level
Use the Active Directory Domains And Trusts console
You cannot lower the functional level after you raise it, except by reinstalling Active Directory on all of your domain controllers
Once the functional level is raised on that one domain controller, the change is replicated to all of the other domain controllers in the domain.

11. Local vs. Domain groups
Windows Server 2003 supports local groups and domain groups.
A local group is a collection of local user accounts on a particular computer.
Local groups perform the same basic function as all groups: they enable you to assign permissions to multiple users in one step.
Local groups are created using the Local Users And Groups snap-in, which is integrated into the Computer Management console
When you create a local group, the system stores it in the local Security Accounts Manager (SAM) database

12. Restrictions on LOCAL GROUPS
You can use local groups only on the computer where you create them.
Only local users from the same computer can be members of local groups.
When the computer is a member of a domain, local group members can include users and global groups from the domain or any trusted domain.
Local groups cannot have other local groups as members.
Local group permissions provide access only to resources on the computer where you created the local group.
You cannot create local groups on a Windows Server 2003 computer that is functioning as a domain controller.

13. ACTIVE DIRECTORY GROUPS
Active Directory groups are characterized by their type and their scope
Types
Security
Distribution
Scopes
Local
Global
Universal

14. ACTIVE DIRECTORY GROUP TYPES
Security Groups: used to assign access permissions for network resources
Membership depends on the type of security group and the domain functional level.
Can also be used as a distribution group.
The most common type of group created and used in Active Directory.
Distribution Groups: Used to group users together for use by applications in non-security-related functions
You use distribution groups when the only function of the group is not security-related, such as sending messages to a group of users at the same time.
Can be used only by directory-aware applications
Can be converted to a security group

15. ACTIVE DIRECTORY GROUP SCOPES
Group scopes define how permissions are assigned to the group members
The 3 Scope Levels are:
Domain local
Global
Universal

16. DOMAIN LOCAL GROUPS
Domain local groups are most often used to assign access permissions to network resources, like printers or shared folders, in a single domain
Available in all domain functional levels
Can only be used to assign permissions to resources in the domain where they are created
Permitted membership depends on domain functional level
In Windows 2000 mixed or Windows 2003 interim functional level, members can include user and computer accounts and global groups from any domain in the forest.
In Windows 2000 native or Windows Server 2003 functional
level, members can include user and computer accounts, global and universal groups from any domain in the forest, and other domain local groups from the same domain

17. GLOBAL GROUPS
Used to collect users or computers in the same domain that share the same job, role, or function
Global Groups are given access to network resources by making the group a member of a Domain Local group
Most commonly used to manage permissions for directory objects, such as user and computer accounts, that require frequent maintenance.
More efficient than using Universal groups because they are not replicated outside of their domain. This minimizes the amount of replication traffic to the global catalog,
Available in all functional levels
Can include only members from within their domain
Actual membership depends on domain functional level
Can be granted access permissions to resources in any domain in the forest, and in domains in other trusted forests

18. UNIVERSAL GROUPS
Used primarily to grant access to related resources in multiple domains.
Generally used to consolidate groups that span multiple domains
To use universal groups effectively, the best practice is to create a global group in each domain, with user or computer accounts as members, and then make the global groups members of a universal group
Available only in the Windows 2000 native and Windows Server 2003 domain functional levels
Can be granted access permissions for resources in any domain in the forest, and in domains in other trusted forests
Can be converted to domain local groups or to global groups, as long as they do not have other universal groups as members

19. NESTING GROUPS Nesting Groups is the ability to make groups members
of other groups
a single level of nesting is sufficient for most networks M e m b r s A l o w d i n W 2 x S v 3 I t F u c a L N
Domain
Local
User and computer accounts
and global groups from
any domain
User and computer accounts,
unive
sal groups, and global groups
from any domain; other domain
local groups from the same domain
Global
from the same domain
User and computer accounts and
other global groups from the same
domain
Universal
Not available
User and computer accounts, other
universal groups, and global groups
from any domain G p

20. CONVERTING GROUPS
In a domain using the Windows 2000 native or Windows Server 2003 functional level, you can convert groups to different scopes at any time T o D m a i n L c l G b U v e r s F
Not applicable
Not permitted
Permitted only when the d
main local group does not
have other domain local
groups as members
global group is not a member
of a
other global group
No restrictions
Permitted only when
the universal group
does not have other
universal groups as
members

21. PLANNING GLOBAL AND DOMAIN LOCAL GROUPS
Step 1—Create domain local groups for resources to be shared.
Step 2—Assign resource permissions to the domain local group.
Step 3—Create global groups for users with common job responsibilities.
Step 4—Add global groups that need access to resources to the appropriate domain local group.

22. WINDOWS SERVER 2003 DEFAULT GROUPS
Built-in local groups
Predefined Active Directory groups
Built-in Active Directory groups
Special identities

23. BUILT-IN LOCAL GROUPS
Built-in local groups give users the rights to perform system tasks on a single computer
backing up and restoring files, changing the system time, and administering system resources
Some of these groups have default privileges granted to them through the assignment of user rights to the group
Administrators, Backup Operators, Users, Power User, Remote Desktop Users
Only on Windows Server 2003 standalone servers and member servers.
Domain controllers do not have local groups (or local users) because their SAM is converted for Active Directory use.
Located in the Groups folder in the Local Users And Groups snap-in.

24. BUILT-IN LOCAL GROUPS

25. PREDEFINED ACTIVE DIRECTORY GROUPS
Predefined groups: security groups, most with a global scope, that are intended to group together common types of domain user accounts.
By default, Windows Server 2003 automatically adds members to some predefined global groups.
You can add user objects to these predefined groups to provide additional users with the privileges and permissions assigned to the group
Created in the domain’s Users container
Domain Admins, Domain Controllers, Domain Computers, Domain users
By default, they do not have any inherent rights or permissions
You can assign rights or permissions to them by adding the predefined global groups to domain local groups or by explicitly assigning rights or permissions to the predefined global groups.
By default some of the predefined Active Directory groups have privileges granted to them through the assignment of user rights.
Domain Admins and Enterprise Admins ONLY

26. PREDEFINED ACTIVE DIRECTORY GROUPS

27. BUILT-IN ACTIVE DIRECTORY GROUPS
Every Active Directory domain has a Built-in container in which the system creates a series of security groups, all of which have a domain local scope.
The Built-In groups provide users with user rights and permissions to perform tasks on domain controllers and in the Active Directory tree.
Built-in domain local groups provide predefined rights and permissions to user accounts when you add user objects or global groups as members.
Account Operators, Administrators, Users, Guests

28. BUILT-IN ACTIVE DIRECTORY GROUPS

29. SPECIAL IDENTITIES
Special identities exist on all computers running Windows Server 2003.
These are not really groups because you cannot create them, delete them, or directly modify their memberships.
They are like placeholders for one or more users
Special identities do not appear in the Local Users And Groups snap-in or the Active Directory Users and Computers console
You can use them like groups, by adding them to the ACLs of system and network resources
Examples: Everyone, Authenticated Users, Creator Owner

30. SPECIAL IDENTITIES

31. CREATING LOCAL GROUPS

32. WORKING WITH ACTIVE DIRECTORY GROUPS
Active Directory Users and Computers console:
Create security groups
Manage group membership
Nest groups
Change group types and scopes
Delete a group

33. CREATING SECURITY GROUPS
The Active Directory Users and Groups console lets
you create group objects anywhere you want
Groups should always be created in an OU so that you can assign user rights to them

34. NESTING GROUPS
Both groups must be created separately, and then one is made a member of the other.
Possible nestings depend on the domain functional level and scope type.
Observe rules on group nesting.

35. CHANGING GROUP TYPES AND SCOPES

36. DELETING A GROUP
Deletes only the group object, not the members of the group.
Deletes the SID for the group. The SID cannot be re-created.
Removes ACL entries for the group – all permissions for that group are deleted and are NOT restore even if you make a new group with the same name

37. AUTOMATING GROUP MANAGEMENT
The following command-line utilities can be used in scripts and batch files to automate group management:
Dsadd.exe: Used to create new group objects
Dsmod.exe: Used to configure existing group objects
Dsget.exe: Used to locate groups in Active Directory

38. CREATING GROUP OBJECTS WITH DSADD.EXE
Allows groups to be created from a command line
Useful when scripting group creation for large numbers of groups
Can be used only to create new groups, not modify existing groups
Syntax:
dsadd group GroupDN [parameters]
Ex: Create a new group called Sales in the Users container and make the Administrator user a member
dsadd group "CN=Sales,CN=Users,DC=contoso,DC=com" –member "CN=Administrator,CN=Users,DC=contoso,DC=com"

39. MANAGING GROUP OBJECTS WITH DSMOD.EXE
Can be used to configure group objects, including:
Setting the group scope
Adding and removing individual group members
Replacing the entire group membership
Syntax:
dsmod group GroupDN [parameters]
Example: Add the Administrator user to the Guests group
dsmod group "CN=Guests,CN=Builtin,DC=contoso,DC=com" –addmbr "CN=Administrator,CN=Users,DC=contoso,DC=com"

40. FINDING OBJECTS WITH DSGET.EXE
Command-line utility
Used to locate and show information on an object
Cannot be used to create, modify, or delete an object
Syntax:
dsget objectclass ObjectDN [parameters]
Example: Display a list of the groups of which a user is a member
dsget user "CN=Administrator,CN=Users,DC=contoso,DC=com" -memberof