I want to grant permissions to all of the users in a specific domain. Let's say I have a domain called ACME. I tried to use "ACME\Users" but I received an error stating "The user or group name 'ACME\Users' is not recognized". Which active directory group contains all users in a domain?
1 Answer
If you create a bunch of users on your domain, they will by default by added to the ACME\Domain Users
security group (using your example domain name). Normally, users should be left in that group and that group should be their primary group.
If someone else has made accounts on the domain before you, they may have taken steps to remove users from the ACME\Domain Users
group, which is possible. In particular, there is also a built-in ACME\Domain Guests
group which might be used for guest or temporary accounts. So while you can't guarantee that every domain user is a member of ACME\Domain Users
, it's still your best bet for granting access to something for "everyone on the domain". If an account has been removed from ACME\Domain Users
, there is/was probably a good reason, and you probably don't want those accounts to have access to the resource in question anyway.
Note that another important built-in security group is ACME\Domain Admins
. By default, whenever a computer is joined to the domain, the ACME\Domain Admins
group is added to the local Administrators
group, making domain admins local administrators for all domain-joined computers. Be careful with adding or removing accounts from ACME\Domain Admins
since it's a very powerful group, and some accounts will need to be in it for your domain to work correctly.