Professional Windows Server 1002003 Security A Technical Reference [Electronic resources] نسخه متنی

Domain Setting

If you make a user a

member
of a group in order to grant the user permissions on network
resources but the user is currently logged on to a computer in the
forest, the new permissions will not take effect until the user next
logs on to the network.

You can change both the type and scope of a group after it has been
created, which gives administrators a lot of flexibility.

Use simple and meaningful names for your groups to help other
administrators locate them in Active Directory and to minimize the
amount of time you spend documenting your arrangement. For example,
if the parent domain is

mtit.com , use Support
for the global group used for customer support people in your domain.
Child domains, such as

ny.mtit.com and

sf.mtit.com , could use Support NY and Support SF
for their corresponding global groups in the New York and San
Francisco branch offices.

Domain local, global, and universal groups are created by default
within the Users folder of the Active Directory Users and Computers
console, but they can also be created in any OUt you choose or in a
user-defined OU.

You must be a member of the Enterprise Admins group to modify the
membership of universal groups.

Workgroup Setting

Do not create local groups on

computers
that belong to a domain since local groups can be used to secure
resources located only on the computer on which you create them.

You can't create local groups on a WS2003 domain
controller since a domain controller has no local security database.

Built-in Groups

Members of the Guests built-in
group
can't permanently modify the desktop settings on
their WS2003 computer.

If additional services like Internet Information Services or Terminal
Services are installed on a standalone server, additional built-in
user accounts will be created as members of the Guests group.

You can't change the scope (domain local, global, or
universal) or the type (security or distribution) of a built-in
group. This provides an easy way to determine whether a given group
is built-in or user-defined.

Limit membership in the Domain Admins global group for each domain.
Members of this group have powerful privileges, including the ability
to define domainwide security policies and the ability to take
ownership of any object in the domain. A good strategy is to keep
membership in this group small and to delegate limited administrative
authority over different OUs in the domain to specific groups of
trusted users.

Use built-in groups wherever possible to simplify the task of
granting users rights and permissions to use network resources, and
add users only to those groups that give the users just enough rights
and permissions to access the resources they need on the network.

In addition to user accounts and other groups, you can also make
computer accounts and contacts into members of groups. Active
Directory provides a great deal of flexibility in how groups can be
used.

See Also

Domain , net group,
net localgroup,

Users