Microsoft Windows Server 2003 (70-290) Tutorials
Managing Groups / Best Practices for Groups
Visitors to VTC.com will be able to view all introductory videos for each training course.
Free Trial Members will gain access to first three chapters for each training course.
Full Access Members have full access to VTC.com�s entire library of video tutorials.
Learn More
Subtitles of the Movie (Microsoft Windows Server 2003 (70-290) / Managing Groups / Best Practices for Groups)
You might notice that we have used the AGDLP strategy many times during this training and you should know this like the back of your hand; both for real life as well as for the test. For the test you can almost count on having a couple of questions on 72-290 test in regards to accounts to global groups, global groups to domain local groups and then give the domain local groups the permission. They try to confuse and try to make you to think that may be you put the permissions on to the global group or you put the permissions on to the account. So just remember AGDLP. If we add an universal groups but do not nest then it is accounts to global groups, global group to universal groups, universal groups to the domain local group and then give the domain local group permissions. If we nest then it accounts to global groups , global groups to additional global groups then the resulting global group goes into a universal group, universal group goes into a domain local group and we still give the domain local group the permissions. So always remember that main local group gets the permissions and then you can kind of work it backwards from there. Just remember AGDLP.So, the reason that we need to remember this, number 1, for the test but number 2, it is the right way to do it. And if you take a look at the system Microsoft is actually following their own rules. In fact let us go into active directory users and computers for just a minute and let us take a look as the users container. And in the users container we will find the domain admins global group. Since it is security group it is ***. Let us right click on it, click on properties and see about its memberships. Click on members and look administrator or the administrator account is a member of the domain admins global groups. So that accounts to global groups. Now that global groups should go into a domain local group, right? Well, where is domain local group? Let us click on a built in container and we have a domain local group we slide over here we can see that the administrator's security domain local group. It is in the built in container, and if they are following there own rules then the domain admin's group the global group ought to be in it. So let us right click come to properties and darned if it is not. So Microsoft is actually following there own rules so we need to note for the test, but we also need to note because that is the best way to do it. That is the way that the system is designed to work. So the additional things that we need to know for best practices are, number 1 Name global groups based on their membership, when we say based on the member ship we are talking about what the membership does. Means if they all do the same thing they all are in sales, they all are in accounts or payables for example then they have the same needs, And then if they have the same needs then they need the same resources so that is why we are going to group them in the first place to be able to assign them the permissions for resources. So name the global groups based on the membership and based on what they do. On the other hand name the domain local group based on the resources. So, for example a domain local group of color printers might have global groups in it that are from account payable, account receivable, sales, whoever needs to use color printers goes into the domain local group. When the domain local group itself is named based on the resource. We also need to use built in groups whenever possible. How many built in groups do we have, well we have got lots of them. We have got just in member servers; we have got all kinds of default groups. Administrators, backup operators, guests, network configuration operators, performer loggers, power users. Some of these are new to Server 2003 more operators, more desktop users, replicators, user, help services group, telnet clients. I will be familiar with these just in case a test question says should you use this group and this is in default built in group, or should you create a group. And chances are that the right answer is that you use the default group. For domain controllers we have even more groups. For domain controllers we have even more groups, things that we have in domain controllers groups, or groups we have in domain controllers that we don't have in member servers, include domain users, domain admins, possibly enterprise admins, schema admins depending on which machine it is in. So we have lot of different default groups. Those we could be possibly use for ** but there is the general rule is to use the default group before you create a group. So we use groups to manage permissions and there is a lot to managing permissions. We are going to have whole chapter on it. So the next chapter is all about managing permissions. That is next.
Tutorial Information
| Course: | Microsoft Windows Server 2003 (70-290) |
| Author: | Bill Ferguson/Certified Instructor |
| SKU: | 33497 |
| ISBN: | 1932072918 |
| Release Date: | 2004-06-03 |
| Duration: | 8.5 hrs / 107 lessons |
| Captions: | No |
| Compatibility: |
Vista/XP/2000, OS X, Linux QuickTime 7, Flash 8 |
VTC Sign up & Benefits
- Unlimited Access
- 81,350 Video Tutorials (14,200 free)
- Video Available as Flash or QuickTime
- Over 715 Courses
- $30 for One Month Access
- Multi-User Discounts Available
