1
vote
1answer
53 views

Can I add a local linux user to a supplementary active directory group?

The Linux box in question is a CentOS 6.5 machine that is bound to active directory. I can change a local user's primary group to an active directory group. But i can't add the active directory group ...
10
votes
1answer
101 views

Can I “merge” two groups using SID history?

I have two AD groups which were erroneously created while there should instead have been only one group; they contain the exact same users. However, these groups have been assigned various permissions ...
7
votes
2answers
887 views

Is there a performance impact of direct AD universal groups assignment?

I'm implementing a tool which secures certain shared resources within AD forest (mostly file shares). By some criteria a list of users from different domains is generated, those users are added to a ...
0
votes
2answers
170 views

Set group permission on folder

I have a folder with lots of subfolders D:\Data\Subfolder1 D:\Data\Subfolder2 D:\Data\Subfolder3 D:\Data\Subfolder4 D:\Data\Subfolder5 ... I need to create three active directory groups ...
2
votes
1answer
619 views

(Powershell) Method to return a list of groups where a specific user has 'write member' security

We use a piece of web-based software that users can log on to in order to manage access to shares controlled with AD groups. The list of groups a user can manage are the groups on which they have ...
1
vote
2answers
2k views

How to make security group in one forest show up in another forest?

I have two Win2k8 forests which I do maintenance on. The two forests have full 2 way external, non transitive trust with each other. I have a folder in forest X, domain countryX.mycompany.com ...
1
vote
2answers
198 views

Domain-wide deny ACL not applied?

I was testing something in my lab: I created an account, and then added a deny ACL to the domain, applying to that and all descendant objects, denying full control. However, I found that using adfind ...
4
votes
2answers
4k views

How to allow some (non-admin) users to edit address/phone properties for all AD users?

I need to allow HR people to edit some attributes for all Active Directory users (phone numbers, address, and similar contact informations), without giving them full administrative rights. They will ...
1
vote
1answer
769 views

Windows Server : role of SYSTEM and CREATOR OWNER users?

I'm working on a SBS2003 server, and I'm about to clean up on folder permissions. I notice that quite a few folders have the users SYSTEM and CREATOR OWNER set. Now, I've found descriptions of the ...
3
votes
2answers
2k views

How can I check access of a Group/User in AD before I delete it?

I'm cleaning up an inherited domain that is not well documented. How can I check that a particular group or user has no ACEs across the AD? Things like searching DACL/SACL for AD objects and file ...
1
vote
3answers
479 views

Copying over NTFS ACL's from one offline server to another server

We have two machines on the same domain: Machine A (Windows 2003) and Machine B (Windows 2003). Both have a set of files that are identical and have been kept identical by a scheduled process. ...
1
vote
4answers
10k views

Is it possible to provide access to a domain resource to a non-domain user?

After a security review, I'm splitting the tiers of a Windows 2008 Server application that is currently on a single machine in the corporate domain. I want to move the IIS 7 Web UI to a new machine in ...
6
votes
3answers
7k views

Can Samba support full Windows-ACLs?

I've set up a Samba 3 host with AD integration and an ACL enabled filesystem. Using a windows client I can set users and groups permissions. Up to now, Samba just maps to POSIX ACL's rwx permissions, ...
2
votes
1answer
228 views

Copy permissions Win 2000 DC to 2008 R2 DC in new domain

ADMT 3.1 copies users with passwords and SID history from my Win2k Domain Controller (native) to a new 2008 R2 DC (R2 functional level) in a new forest/domain. Can ADMT also copy folders and files ...
2
votes
2answers
4k views

Grant account write access to specific attributes on Active Directory User object

I am trying to allow an account to update very specific attributes on all User objects. I am setting this security on the "User" object. When I add the account on the security tab, go to advanced, ...
1
vote
0answers
393 views

AFP AD ACL permissions issues with external drive

Mac OS X Server 10.4.11 connected to an AD domain system serving AFP shares to Mac OS X 10.5.8. If I create a share on the the internal RAID of the server with an ACL that allows RW to all ("Domain ...
0
votes
1answer
678 views

Okay to delete “Account Unknown” entries on root of Active Directory? [duplicate]

Possible Duplicate: Is it safe to delete “Account Unknown” entries from Windows ACLs in a domain environment? I recently noticed that all of the objects in my Active Directory ...
1
vote
1answer
437 views

How do I integrate a OpenSolaris NAS with AD?

I basically want a OpenSolaris NAS (ZFS goodies) but I'd like to integrate it with AD, so that when I create a new user in AD, his roaming profile is created in the NAS. That means all his ACLs have ...
0
votes
2answers
582 views

Domain Policies needed when using roaming profiles

We don't usually use roaming profiles, but we need to test some code of ours to make sure we work with this. This led us to set up a roaming profile and then try to use the program in question. On ...
8
votes
3answers
976 views

What good Active Directory + Exchange competition is there?

Based on this question regarding enhanced permission support in filesystems, what is the best permissions + directory and mail stack to compare against Active Directory on NTFS with Exchange? I'm ...
3
votes
2answers
261 views

What filesystem comes closest to matching NTFS for support of ACLs, and highly-granular permissioning?

It seems that most other filesystems handle the basic *nix permissions (ugo±rwx), with maybe an addition here or there. Or can be "made" to handle ACLs through the use of other tools on top of ...
9
votes
8answers
4k views

Is this a recommended/valid approach for file server permissions?

File servers are a fact of life in IT and I'm curious if there are any generally accepted practices (I hesitate to use the word "best" here) for how you create groups and apply permissions for ...