Windows Forum

Ask something
Discussion Locked

Groups in W2K?

0 helpful
3 replies

by casta 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi all,

I just migrated 2 NT domains into one W2K AD (You probably have seen my previous questions!) The AD is running in native mode and I am would like to know what do you guys recommend in regards to administering a single W2k domain.

Do I need to assign users to global groups and then add the global groups to domain local groups in order for me to assign user permissions to files and folders that are shared in a W2k member server? not on the AD server itself.

How about just using universal groups and bypassing global and domain local groups all together. Is this recommended?

You are probably wondering since I used the ADMT to migrate those NT domains and everything is working fine since I put the AD in production (about 3 days ago!) then why am I bothering re-assigning groups and permission and not leave it alone!

Well, I feel since that I placed a great amount of MY time researching and designing my AD structure and that this is my first W2k domain that I don't want to carry any "baggage" from the previous NT domains and their administrators.

Besides, during the migration I could see that there were "too many" full control permission and admin permissions. So, yeah I am definetly starting from scratch so that I can learn obviuosly about groups and permissions ;-).

It might be a power trip but I want to design it my way, the right way from the start!

Thank you for your time.

3 replies

by ewgny

You'll only want to use universal groups for a multiple domain forest. There is just no need for them in a single domain. Global groups should be created to organize users who require similar access needs.
For example - Sales agents, administration, public users etc.
You would then make global groups members of Domain local groups, which are used to assign access to resources. But honestly that can be a pain in the butt on a small domain. You may find yourself making redundant global and domain local groups. For what, just to add the global group to the Domain local ? So on a small Domain, many people stick with just using global groups. Then adding Domain local groups only when there seems to be a need to add several global groups to it.

by casta

ewgny,

I found myself making redundant groups and that is exactly the reason why I posted this question.

Thank you for your guidance.

JC

This discussion is closed to new replies.