• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 790
  • Last Modified:

Global group grants access for file permissions but domain local group does not

I'm setting up the permissions for access to shared drives on the servers in our system. (Should have been done years ago but then again, everything I've been doing since I started working here a few months ago should have been).  I'm reasonably new to active directory and domain management and stuff, so this might be a simple solution.

Anyway, I'm trying to do everything right, so I have global groups that are part of domain local groups and the domain local groups are given permissions.  The problem I'm having is the permissions on a different server (same domain).  When I give permissions to a domain local group, only the people in that group that are also domain admins actually get permissions.  But if I add the global group that is a member of the domain local group directly to the folders permissions, then all users get access.  I'm not really sure where to go from here.

Thanks for the help.

P.S. Both servers in question are Windows 2003 R2
0
mjburgard
Asked:
mjburgard
  • 3
  • 3
3 Solutions
 
Rant32Commented:
If you are going to use the AGLP paradigm, then you should create the local groups on the local server, if that server is a domain member. Then add the domain Global groups as a member to those local groups.

The Domain Local groups can only be used on domain controllers.

The Domain Admins group probably inherited their permission another way (e.g. by being a member of the computer-local Administrators group). You can't assign rights to Domain Local groups on member servers, or use them in other domains.

About group scopes: http://technet.microsoft.com/en-us/library/cc755692%28WS.10%29.aspx
0
 
mjburgardAuthor Commented:
Ok I guess I'm worse of then I thought, cause I can't figure out how to create local groups on the other server.  I'm assuming its just with some windows component that I don't have installed or something.
0
 
Rant32Commented:
You can use Computer Management | Local Users and Groups | Groups
This snap-in is not available on domain controllers, just domain members and workgroup servers.

The commandline to add a new local group is: NET LOCALGROUP "Groupname" /ADD /COMMENT:"Description"

The commandline to add domain global groups to that group is: NET LOCALGROUP "Groupname" "DOMAIN\Groupname" /ADD
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
mjburgardAuthor Commented:
Ok I found that and was able to make groups, but now when I go to the folders on that computer and try to add the groups to the permissions it can't find them.  Tried searching entire directory and the local computer, didn't find it either way.  I'm sure its something else simple that I am missing.
0
 
Rant32Commented:
Typing partial names in the 'Select Users, computers and groups' dialog and then "Check names" will not find local groups on a member server. You must type the full group name (including computer name as above) or use: Advanced | Location... | Change to local computer | Find Now, to find all groups.

Yes, they did make that unnecessarily difficult.

Check names works only for objects in the domain, and only if the group name starts with the partial text.

For good measure, can you try typing: computername\groupname
into the search box when adding your group? See if it can find that? If that doesn't work, please tell us exactly what steps you are taking to create and find the group, because I'm not seeing the issue.

There is no shame in using Global groups to assign permissions to resources on member servers, and then add other global or universal groups to those "ACL groups", as I call them. The only restriction is that global groups cannot contain global groups from another domain, only universal groups (see above link). It does have a few advantages over using local groups, from an ease of management point of view.
0
 
mjburgardAuthor Commented:
Cool, that seems like it worked.  Thanks for all the help, hopefully I'll learn from this and be able to do more in the future.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Protect Your Employees from Wi-Fi Threats

As Wi-Fi growth and popularity continues to climb, not everyone understands the risks that come with connecting to public Wi-Fi or even offering Wi-Fi to employees, visitors and guests. Download the resource kit to make sure your safe wherever business takes you!

  • 3
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now