You should use (domain) local groups and global groups to separate your organizational structure and user roles from the physical access.
You use (domain) local group to control access, and global groups to represent your organization.
In other words:
* treat each folder that requires different permissions as a different resource, and create domain local groups to control access.
* put your users into global groups according to their role in the company; add the global groups to the domain local groups to give them the access they need.
In your example:
Create a DL group "NTFS-Accounting-C" and a group "NTFS-Accounting-R"; give the first group Change permissions, the second one Read.
Do the same for other folders where you need to have different access methods.
Then group your users NOT by file access on your server; group them by corporate needs or roles, and add them to the resource groups where they require access.
If you consequently follow through with this, you're able to determine where a user has access simply by looking at his group membership, instead of running NTFS tools on the file server.
In addition, should you ever need to migrate into another domain, or allow access through a trust in general, it's just as easy: add the global groups from the other domain to the DL groups in your domain, and you're done. No need to change NTFS security all over the place.
Check here, too: http://en.wikipedia.org/wi
Main Topics
Browse All Topics
by: SkysharkPosted on 2009-09-17 at 19:19:33ID: 25362567
See this post here...should help clarify. In a single domain/single forest scenario...it shouldn't matter which group type you select since the members will be in the same domain as the objects you'll be applying rights to are in as well.
http://technet.microsoft.c