Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am working with an application that allows security to a hierarchy of folders to be set through Active Directory. I have run into an issue with the application where it seems that the default security mode for all users is full access, and only those users that are deliberately excluded will not be able to receive access. So I would thus like to set the permissions so that all users/groups in a domain are excluded, and then explicitly include the groups and users that should have access.

So my question: is there a way that I can refer to all groups and/or users within Active Directory? For domain ABC, and user XYZ, I would input ABC\XYZ. Same for a group. Is there a syntax like ABC\* that would be a blanket reference to all users and groups for the domain? Or would I have to go in and exclude them all explicitly?

share|improve this question

5 Answers 5

up vote 5 down vote accepted

"Authenticated Users" includes all domain users, not sure if this would be available within your application but it works for group policies.

share|improve this answer
1  
Another option is "Domain Users" (I would add this through an edit, but don't have enough rep yet) –  Yaakov Ellis May 7 '09 at 15:20

"Everyone", "Domain Users" or "Domain Admins" etc. are other ways to reference your users.

See this article with more info (I think it is still valid today)

Important text:

However, if you've enabled the Guest account, you'll find that users who have logged on as Guest are members of Everyone but not members of Users or Authenticated Users.

share|improve this answer

Perhaps you can use the "Authenticated Users" system group? If I remember correctly, Active Directory uses a "deny by default" rules where it will only allow access to those specifically granted access in the ACL for an object. If you only want to allow certain users or groups, clear the list and add only those that you want to have access with the permissions desired. If there is a specific user that you do not want to have access that is part of a group that otherwise would have access, add them to the list with a specific "deny all" rule which will override the group setting for that user.

share|improve this answer

I don't have a full reply to you, but a lead. AD is LDAP. It is queried just like any other LDAP. You will have to find the LDAP "recipe" that suits your needs.

share|improve this answer

If you are dealing with NTFS permissions, your model will not work. If you deny everyone access, then allow certain users, the deny will take precedence.

You need to remove the default access, and then allow certain users. Windows NTFS will only allow access if someone has been explicitly granted the rights - you don't need to explicitly deny them if you don't want.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.