Posts Tagged group membership
Active Directory: Groups
Posted by Harv in Server 2003, Server 2008, Windows on December 30, 2009
Distribution Groups
- These can not be used to perform any sort of ACL (access control) or permissions, and are therefore ill-suited for anything other than to create a list of users to whom you might want to, say, email. If in doubt, use a security group instead.
Security Groups
There are different types of security group. Note that the type simply defines the scope and replication.
- Universal: Objects in this group type are replicated to other domain trees within the forest. Note that global catalog servers have to replicate this information, so heavy use is not encouraged. Can be comprised of users or groups from any domain. See note (1).
- Global: Can only contain objects within the domain.
- Domain Local: Can contain objects from any domain, but are used to control access only to local resources. See note (2).
(1) – In Server 2008 we now have the UGMC (universal group membership caching) feature, which can counteract some of the overhead associated with using many universal groups. This doesn’t mean it’s okay to ignore common sense and best practises though!
(2) – Domain local is best used to control access to resources. Consider a file share: you create a domain local group called, for example, “Sales Share”. Now you allow the sales share read/write/whatever access. Note that this is domain local. Now instead of modifying the share permissions to add all the associated users/groups, you simply add the sales groups from each relevant domain as members of this group. Now when new sales people come in and go out of the company, your work is already done.
In short:
Domain local – can come from any domain but only access local resources.
Global – can only be from this domain but can access resources in any domain.
Universal – Replicated across the forest, can be from any domain and can have access to resources in any domain.
Originally posted 2009-09-20 01:42:14.
Active Directory 2008 Notes 3: The Global Catalog
Posted by Harv in Server 2008 on December 30, 2009
Global Catalog Servers
- Validates group membership.
- Enables forest-wide search for resources or AD objects.
- Validates UPN’s across entire forest, allowing logon to other domains.
Promoting a domain controller to a global catalog server
- The first domain controller in each domain is automatically set up to be a GC server. Every DC that gets added to an already-existing domain has the option of also serving as a GC. This may be desirable, for example, if one domain is divided into two sites or physical locations.
- On the DC, open Active Directory Sites and Services.
- Expand Sites, Servers, and the entry for the domain controller which will be designated a global catalog.
- Right-click NTDS settings, choose properties.
- In the General tab, check the global catalog option. Press OK or apply.
- That’s it! Apply the steps in reverse order to demote a DC from GC duty.
UGMC (Universal group membership caching)
- If UGMC is enabled, users’ universal group information is cached when the user logs on to the domain for the first time. This allows future requests to be serviced quickly, without the need to contact the GC.
- This also allows a lower-spec RODC or DC to be on-site with a high end DC GC server elsewhere.
Enabling it
- Open up AD Sites and Services.
- Select the site which needs UGMC caching.
- Right click NTDS Site Settings, choose properties.
- Select Universal Group Memership Caching.
- Specific sites can be used for replication. Use the drop-down selector if necessary.
- Click ok.
When it’s necessary – or How do I decide between additional GC’s and UGMC?
- In a single domain forest, GC servers nor UGMC provide any benefit.
- If users complain that logons are slow but resource access is not, go with UGMC.
- If users complain that logons are slow and resource access across a link (WAN) is slow, go with GC.
- Having additional GC servers and UGMC is not beneficial at the same site.
Originally posted 2009-06-30 09:00:48.
Recent Comments