From LedHed's Wiki
Revision as of 22:57, 23 August 2013 by Ledhed (Talk | contribs)

Jump to: navigation, search

Active Directory supports 4 types of groups: BuiltIn Domain Local Global Universal

By default most groups are created as Global Groups.


Granting Group Permissions To Trusted Domains/Forests

Universal Groups: Exist across all Domains that Trust each other. Global Groups: Good for containing Users and Groups (and thats about it) Domain Local Groups: Good for Delegating Control.

Example

Goal: Delegate control of password resets, across all trusted domains.

  1. Create a Domain Local group named 'PasswordReset', in each domain.
  2. Create a Globl Group named 'HelpDesk', in each domain.
  3. Create a Universal Group named 'Enterprise Password Reset', on only one domain.
  4. Make users you want to be able to reset passwords MembersOf of the 'HelpDesk' Global group, in each domain.
  5. Make 'HelpDesk' on each domain a MemberOf the 'Enterprise Password Reset' Universal group.
  6. Make the 'Enterprise Password Reset' Universal Group a MemberOf the 'PasswordReset' Domain Local group, on each domain.
Domain A
   (DL) PasswordReset
   (GG) HelpDesk  (MemberOf: Domain A\Enterprise Password Reset)
   (UG) Enterprise Password Reset  (MemberOf: Domain A\PasswordReset)
Domain B
   (DL) PasswordReset
   (GG) HelpDesk  (MemberOf: Domain A\Enterprise Password Reset)
Domain C
   (DL) PasswordReset
   (GG) HelpDesk  (MemberOf: Domain A\Enterprise Password Reset)


This would allow members of the HelpDesk group in any domain to reset passwords in trusted domains (A,B,C)



Group Scope

Source Group Type Relationship Target Group Type Local Domain Trusted Domain
Domain Local Members Domain Local Yes No
Domain Local Members Global Yes Yes
Domain Local Members Universal Yes Yes
Global Members Domain Local No No
Global Members Global Yes No
Global Members Universal No No
Universal Members Domain Local No No
Universal Members Global Yes No
Universal Members Universal Yes No
Source Group Type Relationship Target Group Type Local Domain Trusted Domain
Domain Local MemberOf Domain Local Yes No
Domain Local MemberOf Global No No
Domain Local MemberOf Universal No No
Global MemberOf Domain Local Yes Yes
Global MemberOf Global Yes No
Global MemberOf Universal Yes No
Universal MemberOf Domain Local Yes Yes
Universal MemberOf Global No No
Universal MemberOf Universal Yes No