Microsoft

Ask something
Discussion Locked

Domain Local & Domain Global groups - specific scenario

0 helpful
1 reply

by mindsink 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Ok, I am running a W2K3 domain (W2K3 functional level) and I've read a lot regarding best practices, etc., with using different types of groups.

However, I have not read anything that answers this scenario:

I have a global group called "marketing". I put all the users in the marketing department in there.

I need about 25% of the people on the marketing group to have read-only to this particular file share. I also need select members from other departments to have modify rights to this file share. The file share sits on a domain controller.

I then created two domain local groups called "X.share.read-only" and "X.share.modify".

According to Microsoft's best practice, I am to add users to global groups then put global groups into local groups.

If I do this, then I will have to create two global groups for the sole purpose of grouping the users who will have read-only and modify permissions respectively to this particular file share.

Well, I already created the two domain local groups that do just that. It would seem silly to add users to a global group which essentially becomes a resource group, then add that group to a domain local group which serves the same purpose.

Now, what is the problem in adding the users directly to the domain local groups?

Am I missing something here???

1 reply

by tmalo627

The best practices you've read are correct. They are designed to allow for multiple domain enterprises. You may only have one domain now, but what about the future?

These best practices go back to the inability of Server 2000 to be able to nest global groups within one another. In a multiple domain enterprise where trusts have been established, Domain local groups can contain users and user groups from any domain and have access to resources only of the domain in which the local group lies. Global groups contain users and user groups from only the domain in which it is created, but have access to resources of any domain.

There is also an advantage to quickly identifying what permissions someone has (or should have) to a particular resource by simply looking at their group membership. If a user calls you up saying he's unable to kill a print job that's frozen ahead of his, and you check his profile to see he's in the "print only" group, you know what the problem is.

This discussion is closed to new replies.