The idea of groups exists across all major operating systems. Groups are objects that contain other objects, usually users. This allows for simplification of access control assignments when many people need access to the same resources.

learn more… | top users | synonyms

19
votes
4answers
20k views

Is a reboot required to refresh permissions after adding a user to a new group?

On ubuntu server, I've noticed more than once now that after adding a user to a group that user doesn't have group permissions until I reboot the system. For example: User 'hudson' needs permission ...
18
votes
4answers
38k views

How do I add a group in Mac OS X 10.6?

Surprisingly, it's been tough for me to find the command(s) to do this. Does anyone know how to add a group? Thanks! Or do something like this: # create the MySQL group dscl . create /Groups/mysql ...
18
votes
6answers
15k views

Default groups assigned to the first user in Ubuntu Server 8.04?

I just made a silly mistake on my Ubuntu Server box: I added myself to a group using usermod -G, after which I discovered the -a option... The result is that I am now out of the admin group, and ...
14
votes
4answers
19k views

How to authenticate users in nested groups in Apache LDAP?

I've working LDAP authentication with the following setup AuthName "whatever" AuthType Basic AuthBasicProvider ldap AuthLDAPUrl "ldap://server/OU=SBSUsers,OU=Users,...
13
votes
5answers
25k views

How do you force an update to a user's group membership in Windows 7?

I am writing a web application that uses .NET Windows Authentication and relies on a user's group membership to Authorize them to various areas of the website. Right now I'm on a dev machine that IS ...
13
votes
3answers
24k views

What User Should NGinx and PHP be running as?

Permissions are something that have confused for me a while with Linux. So at the minute both my NGinx and PHP-FPM instances are running with the user and group : www-data Is this standard? I ...
12
votes
2answers
2k views

Temporary membership to AD group

We restrict the running of exe's across the organization. But based on justifications & approvals we add users to (specific) AD groups for 24 hours. Currently the process of removing the users ...
12
votes
2answers
5k views

Puppet: how to create and manage unix users and groups

This last week I spent all effort into learning Puppet. Now I suffer from a mental buffer overflow and little confidence of ever being able to tame this beast. I came across many annotated examples ...
11
votes
4answers
2k views

Managing access to multiple linux system

A searched for answers but have found nothing on here... Long story short: a non-profit organization is in dire need of modernizing its infrastructure. First thing is to find an alternatives to ...
11
votes
2answers
12k views

SQL Server 2005 / 2008 - multiple files / filegroups - how many? Why?

I'm a developer at heart - but every now and then, a customer doesn't have a decent DBA to deal with these issues, so I'm called in to decide.... What are your strategies / best practices when it ...
11
votes
2answers
10k views

Is there a way to refresh computer group membership without rebooting?

I am using Windows Server 2008 R2 and have a windows service running under "network service" account in computer ComputerA. This windows service want to access a share folde (on another computer ...
10
votes
3answers
7k views

In SQL Server, when should you split your PRIMARY Data FileGroup into secondary data files?

Our database currently only has one FileGroup, PRIMARY, which contains roughly 8GB of data (table rows, indexes, full-text catalog). When is a good time to split this into secondary data files? What ...
10
votes
1answer
389 views

Can I “merge” two groups using SID history?

I have two AD groups which were erroneously created while there should instead have been only one group; they contain the exact same users. However, these groups have been assigned various permissions ...
9
votes
1answer
332 views

What are the implications of converting all my groups to universal groups?

In Exchange 2010 distribution groups must be universal. This is supported by documentation You can create or mail-enable only universal distribution groups. I am trying to create a role based ...
8
votes
2answers
80k views

List All Groups and Their Members with PowerShell on Win2008r2

I am new to powershell, but I've been reading manuals and practiced a little bit. My objective is to List all users in all Security Groups under specified path. I have found the way to do it: get-...
8
votes
4answers
5k views

Where should I place group shared files on a Linux system?

I'm migrating a lot of small custom scripts and data from a Linux system to another. On the old system we had a shared user that owned most of the files and they where located in that users /home, ...
8
votes
2answers
5k views

What is the canonical use for the “sys” and “adm” groups?

Since the beginning of time (or as long as I remember anyway) linux systems have had a "sys" and an "adm" group. What is the canonical use for them? Would it be appropriate to use either for a "super ...
8
votes
3answers
4k views

What are the consequences of an AD group that has as its member a group, that is already a member (Cyclic references)

I have been looking at an Active Directory that has several thousand groups, where pairs of groups are members of each other. GroupA has GroupB as a Member. GroupB has GroupA as a Member. Oy. I am ...
7
votes
4answers
10k views

Preventing 'Reply-All' to Exchange Distribution Groups

This is another question in a short series regarding a challenging Exchange project my co-workers have been asked to implement. (I'm helping even though I'm primarily a Unix guy because I volunteered ...
7
votes
5answers
10k views

Can't access windows share when in security group assigned to share

I'm a bit stumpped on this one. I created a security group in AD called "special data users" and add myself to it. I then created a share on a server and give that AD security group full access to ...
7
votes
1answer
180 views

Reset GID/UID auto-increment numbers

I created a virtual mail user for postfix virtual mailboxes with a gid/uid of 5555, but now every new user I create starts at > 5555, is it possible to reset the autonumbering so normal users will be ...
7
votes
1answer
12k views

Granting Domain Admin privileges to a cross-forest user account?

Does anyone know of a way to [effectively] have a user or group in one forest acquire the privileges of the Domain Admin group in another forest? The obvious approach of adding Domain Admins@...
6
votes
2answers
17k views

Show all users and their groups/vice versa

I know I have existing groups and users but I'm not sure about their association. Is there an shell command I can use to list all users or all groups and a command to list all groups/users for a ...
6
votes
1answer
2k views

How can I generate a list of the security groups a set of users belong to?

I have been asked to generate a list of the security groups (so specifically not the distribution groups) that a list of approximately 50 users belong to. I have a list of users, users.txt that ...
6
votes
1answer
194 views

Directory with read and write for a user is permission denied, but fine with execute permissions

I have some weirdness with my users/permissions. I currently have a user named world that has the groups world www-data admin. I have a directory at /var/abc which has the permissions 0644 or rw-r--r--...
6
votes
3answers
12k views

How can I proxy multiple LDAP servers, and still have grouping of users on the proxy?

I have 2 problems that I'm hoping to find a common solution to. First, I need to find a way to have multiple LDAP servers (Windows AD's across multiple domains) feed into a single source for ...
6
votes
2answers
3k views

Is it ok to add users to the 'apache' group?

Are there any significant security concerns about adding users to the apache group? I am a programmer and I need access to all the files/directories in httpdocs - is there anything wrong with adding ...
6
votes
1answer
2k views

PowerShell DSC Group Resource - “Could not find a principal with the provided name”

I am trying to use PowerShell DSC to add a domain group to the local administrators group. Here is the code: Configuration TestSetup { Node localhost { Group Administrators { ...
6
votes
1answer
1k views

Windows 7 “Cryptographic Operators”

This TechNet blog states that: Cryptographic Operators: FIPS 140-2 defines a “Crypto Officer” role, which is represented by the Cryptographic Operators group in Windows, first introduced in ...
5
votes
2answers
6k views

Security Group vs Distribution Group

Within our AD set-up there are a lot of security groups, but only 1 distribution group (that a previous admin created). Both types of group contain lists of domain objects (users in the one I was ...
5
votes
3answers
7k views

Prevent user “click-expansion” of Exchange distribution group?

I am a Unix guy who recently picked up powershell to help my Exchange admin coworkers implement a challenging project in Exchange 2010. (The requirements we've been given are challenging if not ...
5
votes
2answers
4k views

find files NOT belonging to group

How do I find files not belonging to particular group? find /home -group NOT test
5
votes
2answers
2k views

How to let non-admins manage selected domain groups' membership?

I'm on Windows Server 2012, Active Directory is on and working. All the project we manage have 2 dedicated groups, one for managers with access to all related files (including invoices, timetables and ...
5
votes
2answers
1k views

In LDAP is it best to nest groups under organizational units or create an organization unit directly under the root dn just for groups?

I'm not sure whether it's better to nest groups under each of my organizational units or to make an organization unit directly under the root DN just for groups. Is one considered best practice over ...
5
votes
2answers
6k views

Share screen session with users in the same group (Linux)

I can create a detached screen session using the following command: [user1@host-pc ~]$ screen -d -m -S sname program ...and resume to it using this command: [user1@host-pc ~]$ screen -r sname Is ...
5
votes
3answers
2k views

How can I restrict Windows AD logon to a certain group?

Our organisation has an AD; all users are in the one OU. I administer a section of the users. We have a bunch of computers that I only want to allow logon by users in a particular AD group (i.e. users ...
5
votes
5answers
3k views

Groups and Permissions: Nested UNIX groups

We are getting more and more outside developers (from different clients) and are beginning to need a better strategy than adhoc adding to our server and adding to them ourcompany group (which owns ...
4
votes
4answers
52k views

Domain Admins vs. Administrators in Windows AD DC [closed]

Having read in [1]: "Domain Admins Members of this group have full control of the domain. By default, this group is a member of the Administrators group on all domain controllers, all domain ...
4
votes
5answers
29k views

How to add a domain user to the local admin group remotely?

I need to add a domain user in the local administrator group remotly and I have to the local admin password
4
votes
5answers
26k views

Creating a Dynamic Group in Active Directory with users from a OU

I would like to create a dynamic group with users from a specific OU in my Active Directory. I can do this perfectly using Exchange Dynamic Distribution List, but of course, Ex DDL's are only for mail....
4
votes
2answers
4k views

How to secure Outlook Web Access against Brute Force attack?

I'd like to secure Outlook Web Access with Exchange 2010 against a brute force attack using account lockout. What is the best way to do this? I have the following group policy: Computer ...
4
votes
1answer
5k views

How do I add a domain user to a group on a non-domain server?

If we are running a server that is not attached to the domain, how would I go about adding a domain user to a local group on that server?
4
votes
4answers
631 views

List users in all specified unix groups

Is there an easy way to get a list of users who are in all specified groups? For example, if I have the following users: fred - rainbow, dell jane - hp zippy - rainbow, hp, dell george - hp, dell ...
4
votes
1answer
6k views

How do I set the default group for a vsftpd user's uploads? (ubuntu 10.04)

How do I set the default group for a vsftpd user's uploads? When I upload a file, the files group is set to the username... How do I get it to automatically set to a specific group?
4
votes
2answers
260 views

Adding an Active Directory to a computer-local group - which scope to choose?

I am aware of the "AGDLP" rule of thumb when it comes to group nesting inside an AD strcture. But now I am wondering if there are any best practises when it comes to adding Active Directory groups to "...
4
votes
3answers
1k views

Puppet module to manage groups not working

I have configured a module to set up a new group using the following documentation: http://docs.puppetlabs.com/references/latest/type.html#group. [root@puppetmaster ~]# cat /etc/puppet/modules/change-...
4
votes
2answers
4k views

dn-based linux groups from ldap

Is there any way to use one of LDAP's DN-based groups for linux groups instead of using the uid-based posixGroup objectclass? More broadly, is there any way I can avoid having one set of groups for ...
4
votes
3answers
6k views

What is the `shadow` group used for?

On my Ubuntu 9.10 system, there's a shadow system group. There does not appear to be any user assigned to this group at all. The only files that I can find belonging to this group are /etc/shadow and /...
4
votes
1answer
489 views

How do I create NIS groups with large userlists

I am trying to create a NIS group with a member list that exceeds 1024 characters. Now I can't do that because the database that NIS uses restricts the value part of the key/value pair to 1024 ...
4
votes
1answer
797 views

Still confused by Permissions - linux, nginx, php-fpm

I have read the canonical answer at What are the best linux permissions to use for my website? However I'm still stuck. My setup is: A developer user 'ade' who owns the directories and files that ...