The idea of groups exists across all major operating systems. Groups are objects that contain other objects, usually users. This allows for simplification of access control assignments when many people need access to the same resources.

learn more… | top users | synonyms

18
votes
6answers
14k views

Default groups assigned to the first user in Ubuntu Server 8.04?

I just made a silly mistake on my Ubuntu Server box: I added myself to a group using usermod -G, after which I discovered the -a option... The result is that I am now out of the admin group, and ...
16
votes
3answers
15k views

Is a reboot required to refresh permissions after adding a user to a new group?

On ubuntu server, I've noticed more than once now that after adding a user to a group that user doesn't have group permissions until I reboot the system. For example: User 'hudson' needs permission ...
12
votes
4answers
30k views

How do I add a group in Mac OS X 10.6?

Surprisingly, it's been tough for me to find the command(s) to do this. Does anyone know how to add a group? Thanks! Or do something like this: # create the MySQL group dscl . create /Groups/mysql ...
12
votes
3answers
19k views

What User Should NGinx and PHP be running as?

Permissions are something that have confused for me a while with Linux. So at the minute both my NGinx and PHP-FPM instances are running with the user and group : www-data Is this standard? I ...
12
votes
2answers
5k views

Puppet: how to create and manage unix users and groups

This last week I spent all effort into learning Puppet. Now I suffer from a mental buffer overflow and little confidence of ever being able to tame this beast. I came across many annotated examples ...
11
votes
4answers
12k views

How to authenticate users in nested groups in Apache LDAP?

I've working LDAP authentication with the following setup AuthName "whatever" AuthType Basic AuthBasicProvider ldap AuthLDAPUrl ...
11
votes
2answers
871 views

Temporary membership to AD group

We restrict the running of exe's across the organization. But based on justifications & approvals we add users to (specific) AD groups for 24 hours. Currently the process of removing the users ...
10
votes
4answers
1k views

Managing access to multiple linux system

A searched for answers but have found nothing on here... Long story short: a non-profit organization is in dire need of modernizing its infrastructure. First thing is to find an alternatives to ...
10
votes
2answers
11k views

SQL Server 2005 / 2008 - multiple files / filegroups - how many? Why?

I'm a developer at heart - but every now and then, a customer doesn't have a decent DBA to deal with these issues, so I'm called in to decide.... What are your strategies / best practices when it ...
10
votes
2answers
7k views

Is there a way to refresh computer group membership without rebooting?

I am using Windows Server 2008 R2 and have a windows service running under "network service" account in computer ComputerA. This windows service want to access a share folde (on another computer ...
10
votes
1answer
251 views

Can I “merge” two groups using SID history?

I have two AD groups which were erroneously created while there should instead have been only one group; they contain the exact same users. However, these groups have been assigned various permissions ...
9
votes
3answers
5k views

In SQL Server, when should you split your PRIMARY Data FileGroup into secondary data files?

Our database currently only has one FileGroup, PRIMARY, which contains roughly 8GB of data (table rows, indexes, full-text catalog). When is a good time to split this into secondary data files? What ...
8
votes
4answers
3k views

Where should I place group shared files on a Linux system?

I'm migrating a lot of small custom scripts and data from a Linux system to another. On the old system we had a shared user that owned most of the files and they where located in that users /home, ...
8
votes
2answers
3k views

What is the canonical use for the “sys” and “adm” groups?

Since the beginning of time (or as long as I remember anyway) linux systems have had a "sys" and an "adm" group. What is the canonical use for them? Would it be appropriate to use either for a "super ...
7
votes
4answers
7k views

Preventing 'Reply-All' to Exchange Distribution Groups

This is another question in a short series regarding a challenging Exchange project my co-workers have been asked to implement. (I'm helping even though I'm primarily a Unix guy because I volunteered ...
7
votes
5answers
6k views

Can't access windows share when in security group assigned to share

I'm a bit stumpped on this one. I created a security group in AD called "special data users" and add myself to it. I then created a share on a server and give that AD security group full access to ...
7
votes
1answer
4k views

Granting Domain Admin privileges to a cross-forest user account?

Does anyone know of a way to [effectively] have a user or group in one forest acquire the privileges of the Domain Admin group in another forest? The obvious approach of adding Domain ...
6
votes
1answer
684 views

How can I generate a list of the security groups a set of users belong to?

I have been asked to generate a list of the security groups (so specifically not the distribution groups) that a list of approximately 50 users belong to. I have a list of users, users.txt that ...
6
votes
1answer
183 views

Directory with read and write for a user is permission denied, but fine with execute permissions

I have some weirdness with my users/permissions. I currently have a user named world that has the groups world www-data admin. I have a directory at /var/abc which has the permissions 0644 or ...
6
votes
1answer
757 views

Windows 7 “Cryptographic Operators”

This TechNet blog states that: Cryptographic Operators: FIPS 140-2 defines a “Crypto Officer” role, which is represented by the Cryptographic Operators group in Windows, first introduced in ...
5
votes
2answers
32k views

List All Groups and Their Members with PowerShell on Win2008r2

I am new to powershell, but I've been reading manuals and practiced a little bit. My objective is to List all users in all Security Groups under specified path. I have found the way to do it: ...
5
votes
3answers
4k views

Prevent user “click-expansion” of Exchange distribution group?

I am a Unix guy who recently picked up powershell to help my Exchange admin coworkers implement a challenging project in Exchange 2010. (The requirements we've been given are challenging if not ...
5
votes
4answers
13k views

How do you force an update to a user's group membership in Windows 7?

I am writing a web application that uses .NET Windows Authentication and relies on a user's group membership to Authorize them to various areas of the website. Right now I'm on a dev machine that IS ...
5
votes
2answers
3k views

Is it ok to add users to the 'apache' group?

Are there any significant security concerns about adding users to the apache group? I am a programmer and I need access to all the files/directories in httpdocs - is there anything wrong with adding ...
5
votes
3answers
2k views

How can I restrict Windows AD logon to a certain group?

Our organisation has an AD; all users are in the one OU. I administer a section of the users. We have a bunch of computers that I only want to allow logon by users in a particular AD group (i.e. users ...
5
votes
1answer
823 views

PowerShell DSC Group Resource - “Could not find a principal with the provided name”

I am trying to use PowerShell DSC to add a domain group to the local administrators group. Here is the code: Configuration TestSetup { Node localhost { Group Administrators { ...
5
votes
5answers
2k views

Groups and Permissions: Nested UNIX groups

We are getting more and more outside developers (from different clients) and are beginning to need a better strategy than adhoc adding to our server and adding to them ourcompany group (which owns ...
4
votes
2answers
3k views

How to secure Outlook Web Access against Brute Force attack?

I'd like to secure Outlook Web Access with Exchange 2010 against a brute force attack using account lockout. What is the best way to do this? I have the following group policy: Computer ...
4
votes
3answers
2k views

What are the consequences of an AD group that has as its member a group, that is already a member (Cyclic references)

I have been looking at an Active Directory that has several thousand groups, where pairs of groups are members of each other. GroupA has GroupB as a Member. GroupB has GroupA as a Member. Oy. I am ...
4
votes
5answers
17k views

How to add a domain user to the local admin group remotely?

I need to add a domain user in the local administrator group remotly and I have to the local admin password
4
votes
4answers
538 views

List users in all specified unix groups

Is there an easy way to get a list of users who are in all specified groups? For example, if I have the following users: fred - rainbow, dell jane - hp zippy - rainbow, hp, dell george - hp, dell ...
4
votes
3answers
12k views

Creating a Dynamic Group in Active Directory with users from a OU

I would like to create a dynamic group with users from a specific OU in my Active Directory. I can do this perfectly using Exchange Dynamic Distribution List, but of course, Ex DDL's are only for ...
4
votes
2answers
137 views

Adding an Active Directory to a computer-local group - which scope to choose?

I am aware of the "AGDLP" rule of thumb when it comes to group nesting inside an AD strcture. But now I am wondering if there are any best practises when it comes to adding Active Directory groups to ...
4
votes
1answer
111 views

How to let non-admins manage selected domain groups' membership?

I'm on Windows Server 2012, Active Directory is on and working. All the project we manage have 2 dedicated groups, one for managers with access to all related files (including invoices, timetables and ...
4
votes
2answers
584 views

In LDAP is it best to nest groups under organizational units or create an organization unit directly under the root dn just for groups?

I'm not sure whether it's better to nest groups under each of my organizational units or to make an organization unit directly under the root DN just for groups. Is one considered best practice over ...
4
votes
3answers
7k views

How can I proxy multiple LDAP servers, and still have grouping of users on the proxy?

I have 2 problems that I'm hoping to find a common solution to. First, I need to find a way to have multiple LDAP servers (Windows AD's across multiple domains) feed into a single source for ...
4
votes
2answers
4k views

Share screen session with users in the same group (Linux)

I can create a detached screen session using the following command: [user1@host-pc ~]$ screen -d -m -S sname program ...and resume to it using this command: [user1@host-pc ~]$ screen -r sname Is ...
4
votes
1answer
448 views

How do I create NIS groups with large userlists

I am trying to create a NIS group with a member list that exceeds 1024 characters. Now I can't do that because the database that NIS uses restricts the value part of the key/value pair to 1024 ...
4
votes
1answer
401 views

Still confused by Permissions - linux, nginx, php-fpm

I have read the canonical answer at What are the best linux permissions to use for my website? However I'm still stuck. My setup is: A developer user 'ade' who owns the directories and files that ...
4
votes
1answer
1k views

What group does a package belong to?

In Fedora 13 distribution, how can one find what an install group a package belongs to? As an example, I would like to know what install group the package inkscape belongs to. Using: yum info ...
4
votes
1answer
422 views

Require membership of more than one group in Apache

I would like to be able to do this: <LocationMatch ^/secret/(.+?)> <Limit GET> Require group member </Limit> <LimitExcept GET> Require group member Require ...
4
votes
3answers
6k views

How do you manage Windows Group Policy for XP, Vista, and Win 7 clients?

DOMAIN = w2k3 DC's only WORKSTATIONS = xp, vista, and now a few Win 7 Enterprise I have the RSAT tools installed on my Windows 7 computer. I can administer Group Policy Management "for the most ...
4
votes
1answer
6k views

Installing Lync 2013 Standard silently

I am trying to find a good way to deploy Lync 2013 standard & basic clients silently on computers with Windows 7 / Office 2010 & ahve a few roadblocks. 1) I am successful installing the ...
4
votes
3answers
412 views

Apache multiple ldap groups

I am configuring Apache to authenticate against LDAP and require multiple groups to be present. I have done this with require statements, however I need the authentication to be successful if all ...
4
votes
1answer
2k views

Linux computer (Debian) in a Windows Active Directory Domain, Administrator of AD should have root permission after login

I managed to join my Debian machine (Squeeze) to an existing Active Directory (MS Windows 2008 R2 Server). Everything works fine, I can login using accounts from the Active Directory (NTP, Kerberos, ...
4
votes
2answers
522 views

Active Directory, Linux, and User Private Groups

We're in the process of moving from NIS on our Linux systems to binding everything to Active Directory. The NIS environment follows the common standard used by many Linux distributions that a user's ...
4
votes
3answers
16k views

Using group policy preferences to push a file to C:\Windows on a restricted user

We have a really old Video learning program that we need to run from the network for our students. However it uses Director Player 6.0 and the students get the error: "Unable to copy the driver file ...
3
votes
4answers
30k views

Domain Admins vs. Administrators in Windows AD DC [closed]

Having read in [1]: "Domain Admins Members of this group have full control of the domain. By default, this group is a member of the Administrators group on all domain controllers, all domain ...
3
votes
3answers
1k views

Active Directory Bulk Group Edit

Is there a way to update the "Managed By" field for every group in Active Directory? I would also need to check "Manager can update membership list" also.
3
votes
3answers
502 views

Allow members of a group to be unlocked by a specific account on AD

Background I'm creating a service to allow support staff to enable their firecall accounts out of hours (i.e. if there's an issue in the night and we can't get hold of someone with admin rights, ...