?
Solved

In W2K Server, what is the best practice for assigning user rights to resources from one domain to another in same forest?

Posted on 2003-03-25
5
Medium Priority
?
204 Views
Last Modified: 2010-03-18
In W2K Server, what is the best practice for assigning user rights to resources from one domain to another in same forest?

What kind of group(s) should I use? etc.

thanks for any inputs in advance.
0
Comment
Question by:losgadas
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
5 Comments
 

Expert Comment

by:chefboy4
ID: 8211655
You can do things to ways.  If your network is in Native mode you can create a Universal group and stick anyone from any domain into it, including groups.  Give the permissions to the resource to this Universal group.  If your domains are not in native mode then you will have to create an account for each person you want to access the other domain on that domain.  Then put them in a group on that domain and give permissions to that group for that resource.  When the person goes to access that resouce they will be prompted for their username and password and domain.  This will be the user account you setup on the other domain.  Hope this wasn't overly confusing.  Any questions to this and I will gladly explain my rambling.
0
 

Expert Comment

by:chefboy4
ID: 8211657
You can do things to ways.  If your network is in Native mode you can create a Universal group and stick anyone from any domain into it, including groups.  Give the permissions to the resource to this Universal group.  If your domains are not in native mode then you will have to create an account for each person you want to access the other domain on that domain.  Then put them in a group on that domain and give permissions to that group for that resource.  When the person goes to access that resouce they will be prompted for their username and password and domain.  This will be the user account you setup on the other domain.  Hope this wasn't overly confusing.  Any questions to this and I will gladly explain my rambling.
0
 
LVL 1

Accepted Solution

by:
BaDaBooM earned 500 total points
ID: 8212095
You can use the Universal groups as chefboy4 suggested, however if you are going to have a lot of these groups I wouldn't recommend it.  It directly affects the size of the global catalog and can therefore slow down GC replication if there are a lot of them.

However, with all due respect to chefboy4, you do NOT have to make user accounts on every domain you wish to use global/local groups (instead of universal).  You can add the user accounts from the other domain to the domain with the global/local group you want them added to.  This is because all domains within a forest automatically have trusts with eachother.  You were even able to do this in NT 4.0 as long as the trusts were there.  It is true that you cannot add a group (other than universal) in one domain to another group (other than universal) in a different domain.  So, to sum up... User Accounts and Universal groups can traverse domains within a forest but NOT global or local groups.  (Universal Groups only available in native mode)
0
 

Expert Comment

by:chefboy4
ID: 8212433
Sorry BaDaBoom... I forgot that the domains where in the same forest.  I have a situation going on at work where they are not in the same forest.  So that was on my mind.  You are correct you can just add the user from the other domain to that group.  You are correct sir!..:)
0
 
LVL 1

Author Comment

by:losgadas
ID: 8212965
Thanks, this works.
0

Featured Post

Portable, direct connect server access

The ATEN CV211 connects a laptop directly to any server allowing you instant access to perform data maintenance and local operations, for quick troubleshooting, updating, service and repair.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article is in response to a question (http://www.experts-exchange.com/Networking/Network_Management/Network_Analysis/Q_28230497.html) here at Experts Exchange. The Original Poster (OP) requires a utility that will accept a list of IP addresses …
An article on effective troubleshooting
Michael from AdRem Software explains how to view the most utilized and worst performing nodes in your network, by accessing the Top Charts view in NetCrunch network monitor (https://www.adremsoft.com/). Top Charts is a view in which you can set seve…
This is my first video review of Microsoft Bookings, I will be doing a part two with a bit more information, but wanted to get this out to you folks.

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question