The document discusses groups and computer accounts in Active Directory. It describes different types of groups like distribution groups, security groups, global groups, and universal groups. It explains how to place users in groups and assign permissions to groups rather than individual users. The document also covers built-in groups, automatic groups, functional levels, converting groups, and using command line tools to manage groups and computer accounts.

1. Network Implementation &
Support
Chapter 4
Group & Computer Accounts
Eric Vanderburg © 2006

2. Groups
• Distribution Groups
• Security Groups
– Local & Domain Local
• For permissions to local resources
• Other groups should be inside
– Global Group
• User accounts should go here
– Universal Groups
• Contains accounts/groups from entire forest
• Native mode only
Eric Vanderburg © 2006

3. Resource 1
User 1
Resource 2
User 2
User 3
Resource 3
Eric Vanderburg © 2006

4. Local Group
Resource 1
Resource 2
User 1
Global Group
User 2
User 3
Local Group
Resource 3
Eric Vanderburg © 2006

5. Local Group
User 1
Resource 1
Global
Group
User 2
Resource 2
Universal
Group
User 3
Local Group
Resource 3
Global
Group
User 1
User 2
Eric Vanderburg © 2006

6. Group Tabs
• General
– Type
– Scope
– Name
• Members
• Member Of
• Managed By
Eric Vanderburg © 2006

7. Group Rules
• Users should be placed in groups
• Permissions should be given to groups,
not individual user accounts
• Users can belong to many groups
• Effective permissions – End result of all
group memberships. All permissions from
all groups are added together but deny
overrides allow (use deny sparingly)
Eric Vanderburg © 2006

8. Built-in Groups
•
•
•
•
•
•
•
•
•
Administrators (Also Domain & Enterprise)
Account Operators - Create and manage user accounts
Backup Operators - backup & restore
Incoming Forest Trust Builders - make one way trusts
to the root forest domain
Network Configuration Operators - Change TCP/IP
settings for DCs
Performance Log Users - configure performance
counters, logs, & alerts
Performance Monitor Users - remotely view
performance monitor
Print Operators
Remote Desktop Users
Eric Vanderburg © 2006

9. Built-in Groups
• Replicator - Can change the way AD data is sent between
DC’s and can start the replicator
• Server Operators - log onto DCs, start & stop services,
backup & restore, format…
• Cert Publishers - Publish CRL, CTL, & Templates
• Enrollment Agent - Issue Certificates
• DHCP Administrators
• DNS Administrators
• Group Policy Creator Owner
• Schema Administrators
• Help Services Group - Manage Help & Support center
(remote assistance)
• Guests
Eric Vanderburg © 2006

10. Automatic Groups
• User Groups
• Everyone
• Authenticated Users – non
guest users
• Interactive – local user
• Network – logged onto
domain
• Creator / Owner
• Anonymous Logon
• Terminal Services User
• Dialup
Program/Service Groups
• Service
• Batch
• System
Eric Vanderburg © 2006

11. Functional Levels
Functional Level
Supported DC OS
Windows 2000 Mixed
Windows NT 4.0
Windows 2000
Windows Server 2003
Windows 2000 Native
Windows 2000
Windows Server 2003
Windows Server 2003 Interim
Windows NT 4.0
Windows Server 2003
Windows Server 2003
Windows Server 2003
• Can be a domain or forest functional level
Eric Vanderburg © 2006

12. Functional Levels
Functional Level
Options
Windows 2000 Mixed
No Universal Groups & Nesting
Windows 2000 Native
Universal Groups Allowed,
Group Nesting Allowed,
Group Conversion Allowed,
SID History
Win Server 2003 Interim
No Universal Groups & Nesting
Windows Server 2003
Universal Groups Allowed,
Group Nesting Allowed,
Group Conversion Allowed,
SID History, Rename DC’s
Eric Vanderburg © 2006

13. Converting Groups
• Groups can be changed by type or scope
• Cannot be changed in a way that would
violate a rule. Ex: Universal group
containing other universal groups is
changed to a global group. (Global
groups cannot contain Universal groups)
• Global cannot be changed to domain local
• Domain local cannot be changed to global
Eric Vanderburg © 2006

14. Computer Accounts
• Used to restrict access to the domain to
certain computers
• Must be Domain/Enterprise admin to add
computers
• Managed computer - connects with a RIS
server to download a Windows
installation tailored for that computer
• Each one has a password. Must be
synchronized at least every 30 days
Eric Vanderburg © 2006

15. Command Line
• Commands can work for the following:
– User
– Group
– Computer
– Contact
– OU
– Site
Eric Vanderburg © 2006

16. Command Line
• Dsadd group “ldap” –secgrp yes –scope u
–memberof “ldap” –members “ldap”
• Dsmod group “ldap” –desc “description” –
rmmbr “ldap of member to remove” –
addmbr “ldap of member to add”
• Dsquery group –scope u –name “name” –
desc “description”
– Can also be used on quotas & partitions
• Dsmove “ldap” –newparent “ldap” –
newname “name”
Eric Vanderburg © 2006

17. Command Line
• Dsrm “ldap”
– removes entries
• Dsget group “ldap” –members -memberof
– Get members or member of groups
• Netdom reset computer /domain: domain
– Reset a computer account
Eric Vanderburg © 2006