Microsoft Windows Server 2003 (70-290) Tutorials
Managing Groups / Group Types and Scopes
Visitors to VTC.com will be able to view all introductory videos for each training course.
Free Trial Members will gain access to first three chapters for each training course.
Full Access Members have full access to VTC.com�s entire library of video tutorials.
Learn More
Subtitles of the Movie (Microsoft Windows Server 2003 (70-290) / Managing Groups / Group Types and Scopes)
The main reason that we use group is to simplify administration of our active directory and, we simplify the active directory by assigning permissions to a group rather then assigning permission to the users or the computers directly. So for example if a user needs access to resource, say for example a printer. Instead of assigning the user direct access to the printer, we will put the user into a group and then give the group access to the printer, so that any one who is the member of that group can have access to the printer and you may say well that sounds like that was one more step. Sounds like that was actually more difficult than if I assigned it directly to the user. And you will be right from one user. What about for hundreds of users? If we have hundreds of users that all needed access to that one printer then it is easier to create groups, and then just put those hundreds of users into the group and which make them a member of that group. So, we use groups to simplify administration but we need to know how to use those groups, both for real life and as well as for the test. So in this chapter we are going to discuss managing groups and in particular we will discuss group scopes and types. Then we are going to discuss strategies for using groups, creating groups, modifying groups and then some best practices for groups. So let us take a look at group scopes and types first. They are basically three different group scopes. These are domain local, global and universal. The domain local group scope must be created in a domain. In other words the resource that the domain local group is controlling must be in the domains. So for example, if I wanted to control your access to a printer by having your account we associate it with the domain local group. Then the printer itself must be in the domain where the domain local group exists. But I am probably not going to put your account into the domain local group. That's where the global group comes along. Global groups typically have members who are users or who are other global groups that is called nesting. So If I wanted to control your access to printer what I would do is I would put your account into a global group. Then I would place that global group into a domain local group and then I would give that domain local group access to the printer. So the domain local group controls the resource and the resource must be local to the domain. The global group controls the user, controls what the user can do based on their membership and the user or the member, because it could be a user or it could be another global group but the member must be local to the domain. The reason is important to understand that is that the universal groups that can be created if our domain is at least Windows 2000 native mode functional level. In another words if we are at native mode for Windows 2000 or above then we can use universal groups. If we can use universal groups then universal groups do not have to have a local resource the resource can be anywhere in the active directory. It can be on any domain and the members can come from anywhere in the active directory from any domain. So there are special users for universal groups that we will talk about later on in our training. We will talk more about group scopes and how we use these different group scopes and put them together in just a minute. Let us talk about group types. There are two different types of groups - security groups and distribution groups. Security groups are what we typically are thinking of when we say group, because we are using a group to manage permissions. Well security group manage permissions. Distribution group, they are used for email list. And there are two reasons that we might want to use distribution group. Number one, the application requires a distribution group. For example Exchange, we can use distribution groups and just pull them right over, infact Exchange for 2000 actually integrates with Windows 2000 and Windows Server 2003. So that the distribution groups that we created on one side are created on the other. So these are for email list. The other reason is that we use distribution group it does not slow down a person log on time based on the group membership, because it is not part of creating their access token for logging on. In other words the system does not look at it as something that t should have to examine because they get some type of permissions for it. So as you can see there is lot of **** pieces here. We have strategies for how we use these. Here we talked very little about the strategy but in our next section we will focus directly on the strategy for using different group types and group scopes.
Tutorial Information
| Course: | Microsoft Windows Server 2003 (70-290) |
| Author: | Bill Ferguson/Certified Instructor |
| SKU: | 33497 |
| ISBN: | 1932072918 |
| Release Date: | 2004-06-03 |
| Duration: | 8.5 hrs / 107 lessons |
| Captions: | No |
| Compatibility: |
Vista/XP/2000, OS X, Linux QuickTime 7, Flash 8 |
VTC Sign up & Benefits
- Unlimited Access
- 81,350 Video Tutorials (14,200 free)
- Video Available as Flash or QuickTime
- Over 715 Courses
- $30 for One Month Access
- Multi-User Discounts Available
