The idea of groups exists across all major operating systems. Groups are objects that contain other objects, usually users. This allows for simplification of access control assignments when many people need access to the same resources.

learn more… | top users | synonyms

16
votes
3answers
13k views

Is a reboot required to refresh permissions after adding a user to a new group?

On ubuntu server, I've noticed more than once now that after adding a user to a group that user doesn't have group permissions until I reboot the system. For example: User 'hudson' needs permission ...
16
votes
6answers
13k views

Default groups assigned to the first user in Ubuntu Server 8.04?

I just made a silly mistake on my Ubuntu Server box: I added myself to a group using usermod -G, after which I discovered the -a option... The result is that I am now out of the admin group, and ...
11
votes
4answers
27k views

How do I add a group in Mac OS X 10.6?

Surprisingly, it's been tough for me to find the command(s) to do this. Does anyone know how to add a group? Thanks! Or do something like this: # create the MySQL group dscl . create /Groups/mysql ...
11
votes
2answers
593 views

Temporary membership to AD group

We restrict the running of exe's across the organization. But based on justifications & approvals we add users to (specific) AD groups for 24 hours. Currently the process of removing the users ...
10
votes
2answers
4k views

Puppet: how to create and manage unix users and groups

This last week I spent all effort into learning Puppet. Now I suffer from a mental buffer overflow and little confidence of ever being able to tame this beast. I came across many annotated examples ...
9
votes
4answers
804 views

Managing access to multiple linux system

A searched for answers but have found nothing on here... Long story short: a non-profit organization is in dire need of modernizing its infrastructure. First thing is to find an alternatives to ...
8
votes
2answers
2k views

What is the canonical use for the “sys” and “adm” groups?

Since the beginning of time (or as long as I remember anyway) linux systems have had a "sys" and an "adm" group. What is the canonical use for them? Would it be appropriate to use either for a "super ...
7
votes
3answers
10k views

How to authenticate users in nested groups in Apache LDAP?

I've working LDAP authentication with the following setup AuthName "whatever" AuthType Basic AuthBasicProvider ldap AuthLDAPUrl ...
7
votes
4answers
2k views

Where should I place group shared files on a Linux system?

I'm migrating a lot of small custom scripts and data from a Linux system to another. On the old system we had a shared user that owned most of the files and they where located in that users /home, ...
7
votes
1answer
2k views

Granting Domain Admin privileges to a cross-forest user account?

Does anyone know of a way to [effectively] have a user or group in one forest acquire the privileges of the Domain Admin group in another forest? The obvious approach of adding Domain ...
6
votes
6answers
445 views

How valuable do you find professional memberships?

I've been a sysadmin for the better part of a decade, but only in the past few years have I really been interested in really bettering myself and the profession. To that end, I joined LOPSA (it was ...
6
votes
1answer
172 views

How can I generate a list of the security groups a set of users belong to?

I have been asked to generate a list of the security groups (so specifically not the distribution groups) that a list of approximately 50 users belong to. I have a list of users, users.txt that ...
6
votes
1answer
160 views

Directory with read and write for a user is permission denied, but fine with execute permissions

I have some weirdness with my users/permissions. I currently have a user named world that has the groups world www-data admin. I have a directory at /var/abc which has the permissions 0644 or ...
6
votes
1answer
574 views

Windows 7 “Cryptographic Operators”

This TechNet blog states that: Cryptographic Operators: FIPS 140-2 defines a “Crypto Officer” role, which is represented by the Cryptographic Operators group in Windows, first introduced in ...
5
votes
2answers
3k views

Prevent user “click-expansion” of Exchange distribution group?

I am a Unix guy who recently picked up powershell to help my Exchange admin coworkers implement a challenging project in Exchange 2010. (The requirements we've been given are challenging if not ...
5
votes
3answers
9k views

How do you force an update to a user's group membership in Windows 7?

I am writing a web application that uses .NET Windows Authentication and relies on a user's group membership to Authorize them to various areas of the website. Right now I'm on a dev machine that IS ...
5
votes
3answers
1k views

How can I restrict Windows AD logon to a certain group?

Our organisation has an AD; all users are in the one OU. I administer a section of the users. We have a bunch of computers that I only want to allow logon by users in a particular AD group (i.e. users ...
5
votes
5answers
2k views

Groups and Permissions: Nested UNIX groups

We are getting more and more outside developers (from different clients) and are beginning to need a better strategy than adhoc adding to our server and adding to them ourcompany group (which owns ...
4
votes
4answers
504 views

List users in all specified unix groups

Is there an easy way to get a list of users who are in all specified groups? For example, if I have the following users: fred - rainbow, dell jane - hp zippy - rainbow, hp, dell george - hp, dell ...
4
votes
2answers
82 views

Adding an Active Directory to a computer-local group - which scope to choose?

I am aware of the "AGDLP" rule of thumb when it comes to group nesting inside an AD strcture. But now I am wondering if there are any best practises when it comes to adding Active Directory groups to ...
4
votes
2answers
281 views

In LDAP is it best to nest groups under organizational units or create an organization unit directly under the root dn just for groups?

I'm not sure whether it's better to nest groups under each of my organizational units or to make an organization unit directly under the root DN just for groups. Is one considered best practice over ...
4
votes
1answer
436 views

How do I create NIS groups with large userlists

I am trying to create a NIS group with a member list that exceeds 1024 characters. Now I can't do that because the database that NIS uses restricts the value part of the key/value pair to 1024 ...
4
votes
1answer
343 views

Still confused by Permissions - linux, nginx, php-fpm

I have read the canonical answer at What are the best linux permissions to use for my website? However I'm still stuck. My setup is: A developer user 'ade' who owns the directories and files that ...
4
votes
1answer
414 views

Require membership of more than one group in Apache

I would like to be able to do this: <LocationMatch ^/secret/(.+?)> <Limit GET> Require group member </Limit> <LimitExcept GET> Require group member Require ...
4
votes
1answer
2k views

Linux computer (Debian) in a Windows Active Directory Domain, Administrator of AD should have root permission after login

I managed to join my Debian machine (Squeeze) to an existing Active Directory (MS Windows 2008 R2 Server). Everything works fine, I can login using accounts from the Active Directory (NTP, Kerberos, ...
4
votes
2answers
502 views

Active Directory, Linux, and User Private Groups

We're in the process of moving from NIS on our Linux systems to binding everything to Active Directory. The NIS environment follows the common standard used by many Linux distributions that a user's ...
4
votes
1answer
507 views

PowerShell DSC Group Resource - “Could not find a principal with the provided name”

I am trying to use PowerShell DSC to add a domain group to the local administrators group. Here is the code: Configuration TestSetup { Node localhost { Group Administrators { ...
3
votes
4answers
21k views

Domain Admins vs. Administrators in Windows AD DC [closed]

Having read in [1]: "Domain Admins Members of this group have full control of the domain. By default, this group is a member of the Administrators group on all domain controllers, all domain ...
3
votes
1answer
18k views

List All Groups and Their Members with PowerShell on Win2008r2

I am new to powershell, but I've been reading manuals and practiced a little bit. My objective is to List all users in all Security Groups under specified path. I have found the way to do it: ...
3
votes
3answers
2k views

What are the consequences of an AD group that has as its member a group, that is already a member (Cyclic references)

I have been looking at an Active Directory that has several thousand groups, where pairs of groups are members of each other. GroupA has GroupB as a Member. GroupB has GroupA as a Member. Oy. I am ...
3
votes
3answers
1k views

Active Directory Bulk Group Edit

Is there a way to update the "Managed By" field for every group in Active Directory? I would also need to check "Manager can update membership list" also.
3
votes
4answers
1k views

Easiest option for sharing users across linux machines?

On windows there's active directory. On Linux there are several options, but what's the dead simplest option to set up? I'd like to manage users and groups centrally, but don't need anything fancy ...
3
votes
1answer
211 views

Can active directory GPO's apply to a group object?

I know I can set up an OU, move user objects in to it, and link a GPO to that OU and that GPO will apply to those users. Is it possible to set up an OU, move a group in to the OU, and have a linked ...
3
votes
1answer
2k views

Changing a group name in AD, effects?

If I change an AD security group name from "name1" to "name2". Will that effect foldershares that are shared out to the group "name1"? Will it automatically be updated to "name2", or will I get ...
3
votes
1answer
1k views

Create group to restart services in CentOS

SYSTEM: CentOS release 6.2 (Final) I am attempting to allow only users of a certain group lets call it websupport access to restart 2 services: mysqld and httpd EDIT: I do not want to give these ...
3
votes
3answers
438 views

Puppet module to manage groups not working

I have configured a module to set up a new group using the following documentation: http://docs.puppetlabs.com/references/latest/type.html#group. [root@puppetmaster ~]# cat ...
3
votes
3answers
3k views

How do you discover what permissions an AD group has, if you have no documentation?

You just got hired at company A and the old administrator is no longer there. Requests start coming through for adding users to the internet restrict group. When you look at the groups none of the ...
3
votes
3answers
6k views

How can I proxy multiple LDAP servers, and still have grouping of users on the proxy?

I have 2 problems that I'm hoping to find a common solution to. First, I need to find a way to have multiple LDAP servers (Windows AD's across multiple domains) feed into a single source for ...
3
votes
1answer
464 views

Dynamic group membership to work around no nested security group support for Active Directory

My problem is that I have a number of network administration applications like SAN switches that do not support nested groups from Active Directory Domain Services (AD DS). These legacy administration ...
3
votes
1answer
664 views

How can a set a Security Group's email address using PowerShell?

I need to create many groups with email addresses. I would prefer to use Security Groups to reduce the number of groups we have to maintain, otherwise we'd have an identical Distribution Group for ...
3
votes
2answers
4k views

LDAP query on linux against AD returns groups with no members

I am using LDAP+kerberos to authenticate against Active Directory on Windows 2003 R2. My krb5.conf and ldap.conf appear to be correct (according to pretty much every sample I found on the 'net). I ...
3
votes
4answers
6k views

AD group membership changes not reflected in winbind information

I have inherited several RHEL5 servers that were set up to authenticate users against their AD accounts via winbind. Everything works fine until I update group membership in AD. For some users, the ...
3
votes
1answer
50 views

recomended order for changing AD groups?

I have a number of domain local resource groups that need: a) to be changed into Universal groups. b) renamed. c) have the users of their member groups collapsed into this group itself. d) remove the ...
3
votes
1answer
2k views

Mac OS X Server (10.8) - SMB sharing permissions don't update (when a user is removed from a group)

We're running a Mac OS 10.8.3 server using the File Sharing feature. We have both AFP and SMB sharing enabled. When we change a user's permissions, their permissions are set properly when accessing ...
3
votes
2answers
188 views

Only a subset of groups available

I have installed RHEL 6.2 and configured for using LDAP with the setup utility and I can login. What is stange is that only three LDAP groups are recognized per user. It is different groups, even for ...
3
votes
2answers
346 views

Linux shared writable directory recursively

How can I make a directory recursively read/writable to a group of users? PROBLEM: This is a directory used by apache so access rights should be fairly strict. The only way I could make it ...
3
votes
0answers
37 views

Debian staff group causes problems

We have an (old and grown) infrastructure of linux machines (mostly debian). For user authentication we use LDAP where we have defined several groups with different access rights. Unluckily one of ...
3
votes
2answers
415 views

Apache groups & users web administration

I am looking for a web administration interface to manage my Apache users & groups. Basically, I would like to be able to : List all users Add a new user Remove a user Create a new group Delete ...
2
votes
4answers
3k views

How to limit access to Exchange 2003 Mobile Activesync server by user?

So I was asked to set up an Exchange Activesync mobile gateway. That's done. It's a separat eExchange 2003 front-end server configured for SSL, and I've put an off-domain ISA server in front of it. ...
2
votes
6answers
2k views

How can I quickly add a lot of users to an Ubuntu server from the command-line?

I've just become familiar with basic usage of adduser. I'd like to eliminate the interaction/prompts. Since I'll be rebuilding this machine often, I'd like to script the process or at worst just ...