Group Strategy

Question 1

Group Strategy Facts

Answer 1

Group Strategy Facts
To make permission assignments easier, assign permissions to a group, then add the accounts that need to use the group’s resources. You can add user accounts, computers, and other groups to groups. Remember the following when assigning members to groups:
Adding a user account to a group gives that account all the permissions and rights granted to the group (the user must log off and log back on before the change takes effect).
The same user account can be included in multiple groups. (This multiple inclusion may lead to permissions conflicts, so be aware of the permissions assigned to each group.)
Nesting is the technique of making a group a member of another group. Using hierarchies of nested groups may make administration simpler–as long as you remember what permissions you have assigned at each level.

To keep the number of groups to a minimum, you should not automatically use universal groups, even though they might be supported.

Use universal groups only if both the users and the resources are located in multiple domains.
You would not need universal groups in a single-domain design.
You would not need universal groups if the resources you were controlling access to were located in a single domain.

Question 2

Strategies

Answer 2

Strategy 1: AGDLP **how to use: **Used in mixed mode domains and in native mode domains (does not use universal groups, which are also not available in mixed mode).
Description:
A: Place user Accounts
G: Into Global groups
DL: Into Domain Local groups
P: Assign Permissions to domain local groups
Application
1. Identify the users in the domain who use the same resources and perform the same tasks. Group these accounts together in global groups.
2. Create new domain local groups if necessary, or use the built-in groups to control access to resources.
3. Combine all global groups that need access to the same resources into the domain local group that controls those resources.
4. Assign permissions to the resources to the domain local group.

Strategy 2: AGUDLP how to Use: Used in native mode domains, when there is more than one domain, and you need to grant access to similar groups defined in multiple domains.
Description
A: Place user Accounts
G: Into Global groups
U: Into Universal groups
DL: Into Domain Local groups
P: Assign Permissions to domain local groups Universal groups should be used when you need to grant access to similar groups defined in multiple domains. It is best to add global groups to universal groups, instead of placing user accounts directly in universal groups.

Strategy 3: ALP How to use: Used on workstations and member servers.
Description
A: Place user Accounts
L: Into Local groups
P: Assign Permissions to the local groups ALP is best used in a workgroup environment, not in a domain.