Windows Server 2003

1
Windows Server 2003???????

• ???
• jeffl_at_ms11.hinet.net

2
How Groups Work
Group

• Group Members Have the Rights and Permissions
  Granted to the Group
• Users Can Be Members of Multiple Groups
• Groups and Computers Can Also Be Members of a
  Group

3
Groups in Workgroups and Domains
Workgroup

• Created on Computers That Are Not Domain
  Controllers
• Reside in SAM
• Used to Control Access to Resources for the
  Computer

Domain

• Created on Domain Controllers
• Reside in Active Directory
• Used to Control Resources in the Domain

4
Managing Local Groups
5
Group Types

• Purpose of Group Types
• Security groupsUse to assign or deny rights and
  permissions
• Distribution groupsUse to send e-mail messages
• Selecting a Group Type
• Use distribution groups unless you need security
  capabilities
• Distribution groups improve logon performance

6
Group Scopes
7
Groups and Domain Functional Levels
8
What Is Group Nesting?

• It means adding a group as a member of another
  group that is the same kind of group scope

Group
Group
Group
Group
Group

• Nest groups to consolidate group management
• Nesting options depend on whether the domain
  functional level of your Windows Server 2003
  domain is set to Windows 2000 native or Windows
  2000 mixed

9
What Are Global Groups?
Global group rules
10
What Are Universal Groups?
Universal group rules
11
What Are Domain Local Groups?
Domain local group rules
12
Creating and Deleting Domain Groups

• Use Active Directory Users and Computers to
  Create and Delete Groups
• When You Delete a Group Its
• Rights and permissions are removed
• Members are not deleted
• SID is never used again

13
Adding Members to Domain Groups
14
Why Assign a Manager to a Group?
Group
Manager

• To enable you to
• Track who is responsible for groups
• Delegate to the manager of the group the
  authority to add users to and remove users from
  the group
• To distribute the administrative responsibility
  of adding users to groups to the people who
  request the group

15
Modifying Groups

• Changing Group Scope
• Global to universal
• Domain local to universal
• Universal to global
• Universal to domain local
• Available in native mode

• Changing Group Type
• Security to distribution
• Distribution to security
• Available in native mode

• Deleting a Group
• Deletes the group but not the objects that are
  members
• Cannot restore a group and its permissions

16
The Strategy for Using Local Groups in a Workgroup
L
Add
Assign
P
A
Assign
Assign
Windows Server 2003
Workgroup
Windows XP Professional
Assign
Windows 2000 Server
Windows 2000 Professional
A

P

L

User Accounts
Permissions
Local Group
17
Group Strategies (1)
18
Group Strategies (2)
19
Group Strategies (3)
20
Group Strategies (4)
21
Group Strategies (5)
22
The Strategy for Using Groups in a Single Domain
23
Why Use Group Strategies
24
Guidelines for Planning a Group Strategy

• Assign users with common job responsibilities to
  global groups

• Create a domain local group for sharing resources

• Add global groups that require access to
  resources to domain local groups

• Use universal groups to grant access to resources
  in multiple domains

• Use universal groups when membership is static

25
Default Groups on Member Servers
26
Default Groups in Active Directory
27
When to Use Default Groups

• Default groups are
• Created during the installation of the operating
  system or when services are added such as Active
  Directory or DHCP
• Automatically assigned a set of user rights
• Use Default groups to
• Control access to shared resources
• Delegate specific domain-wide administration

28
What Are User Rights?
29
User Rights vs. Permissions
User Rights Actions on System
Permissions Actions on Object
30
System Groups

• System groups represent different users at
  different times
• You can grant user rights and permissions to
  system groups, but you cannot modify or view the
  memberships
• Group scopes do not apply to system groups
• Users are automatically assigned to system groups
  whenever they log on or access a particular
  resource