Morning,
Within our AD, we have a naming scheme for groups such as "Accounting-Payroll" and "IT-Manager", etc. We add users to these groups so they can access network locations and Sharepoint sites.
Suggestion has been made to use group names such as "Accounting-Level1" or "Human Resources - Level1."
Research on the interweb suggests using the scheme we have in place but wonder what some of you use for AD naming.
Thanks in advance for reading and responding.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
I dopn't see the point in adding Level1 (or anything similar) as I can't see how it is going to be useful. It may be better to use the approach of identfying groups by Scope and Type (if you use different group scopes and types that is) eg
prefix Global groups with G
prefix Domain Local Groups with DL
and prefix universal groups with U
We tend to split things out like you do, though we add the site.
NY-Payroll
DC-Accounting
SE-ITDept
We then list in the description what the group gives as far as security.
We also do aggregating roles. For example a US Financial Director may have the group US-Accounting that includes DC-Accounting, NY-Accounting, SE-Accounting.
Prefix_scope_target_permis
Prefix:
sg=security global
sl=security local
su=security universal
dl=distribution list
sc=security computer
Scope:
e.g. the domain, site, country, city or whichever the scope is
Target:
e.g. a system, server, application, group of objects etc.
Permission:
typically read/write/modify/full or whatever type of rights you want to delegate
I like to use the good old account group/permission group mentality.
Users go in global/universal account groups, permissions are never given directly to users nor account groups.
Account groups go in (typically domain local) permission groups. Users never go directly to permission groups, and permission groups are granted the permissions or delegated rights to do what is necessary.
Account groups act as "roles" to emulate an RBAC with group memberships.
Example:
The account group "sg_London_Helpdesk" could be added to the following permission groups:
sl_London_Users_ResetPw
sl_London_Users_Modify
sl_London_Fileserver1Share
sl_UK_Workstations_DomainJ
This is of course a completely hypothetical example and those permissions don't necessarily represent anything correct/useful, just to give an idea.
Business Accounts
Answer for Membership
by: demazterPosted on 2009-10-26 at 07:58:35ID: 25662878
My prefered naming convention is:
GRP_SEC_DEPARTMENT_FULL
GRP_SEC_DEPARTMENT_MODIFY
GRP_SEC_DEPARTMENT_READ
GRP_DST_DEPARTMENT
where GRP_SEC=Security Groups GRP_DST=Distribution Groups, I find this helps to keep a good eye on things.