Hot answers tagged

23

"System preferences" -> "Accounts" -> "+" (as if you were adding new account) -> Under "New account" select "Group" -> Type in group name -> "Create group"


22

Assuming all your Domain Controllers are Windows Server 2003 or later you can do this with native Active Directory's dynamic objects functionality without any scripting. Let's say that a user account, "Bob", needs to be in the "Accounting" group for 24 hours. Create a "Bob in Accounting 24 Hours" group and specify an entry-TTL for 24 hours (the duration ...


19

I was looking for a solution, came across this post, and then later found one! I'd thought I'd actually offer a solution so others can benefit. Logging in and out is so 1995. Taken from: https://arkaitzj.wordpress.com/2010/03/08/linux-add-user-to-a-group-without-logout/ So if you needed to get permissions for the cdrom group you just added your user to: ...


19

Besides AuthLDAPSubGroupDepth, that is available only in apache 2.4, it is possible, when using Microsoft AD LDAP, to do authorization using nested groups by using LDAP_MATCHING_RULE_IN_CHAIN matching rule. This is much faster than searching subgroups on the client, because it is done on the DC server with less queries over network. Require ldap-filter ...


18

There's two parts to this question: when to add a new FILEGROUP, and when to add a new FILE in a filegroup. First let's talk theory: Mark's right about the primary reason being performance. The secondary reason is disaster recovery. With SQL Server 2005 and newer, you can do filegroup restores. When disaster strikes, you can restore just your primary ...


18

When adding a user to a new group, the user must log out and log back in for it to take affect. While a reboot will accomplish that, it should not be required.


17

Gimme the codes! powers, activate! $Groups = Get-ADGroup -Properties * -Filter * -SearchBase "OU=Groups,DC=corp,DC=ourcompany,DC=Com" Foreach($G In $Groups) { Write-Host $G.Name Write-Host "-------------" $G.Members } The point being, just take your time and break it out into steps. I know that it's fun to try to get everything and the ...


16

The basic rule of thumb is to separate files onto different volumes to avoid contention, however the anmount of performance gain you get varies wildly by I/O subsystem and workload. For instance, multiple files on a single physical spindle is going to suck as far as performance goes, but the same arrangement with the volume being on a SAN LUN with several ...


15

FreeIPA is probably what you're looking for. It's to Linux what Active Directory is to Windows. (It can also talk to AD if you have a heterogeneous environment, but shouldn't be used to manage Windows machines directly. Use AD for that.) Red Hat's documentation (they call it Identity Management) is very thorough and easy to follow, and should be mostly ...


14

Michael's answer was the closest, but I wanted to be sure, so I installed a fresh copy of Ubuntu Server 8.04.2 (Hardy Heron) in a virtual machine to get the official group list. The installation was a basic one with no specific server roles selected. These are the first groups, assigned by default, to the first user: $USERNAME (e.g. wayne) (primary group ...


14

You need to set AuthLDAPSubGroupDepth to make this work. The integer you provide here specifies the maximum sub-group nesting depth that will be evaluated before the user search is discontinued. Add this to your config: AuthLDAPSubGroupDepth 1 More Info: here and here.


12

I've used these to add dba group: sudo dscl . -create /groups/dba sudo dscl . -append /groups/dba gid 4200 sudo dscl . -append /groups/dba passwd "*"


11

This is how this works: When you login via FTP/SSH and upload files, they are created with your permissions. Probably your webroot is world writable (0777), that is insecure - every user in system can write something there. PHP runs with different user privileges (They are specified in PHP-FPM config, not nginx config), and as directory is world writable, ...


11

You don't. There has to be a trust between the computer and the domain (aka joining the computer to the domain) to be able to authenticate domain users locally. Now for something practical: You have two options 1) create a local user with the same username and password as the domain user, and add that local user to the local group. 2) Join the machine ...


10

When you added yourself to the group, did you log out of your workstation and log back in? Security Group membership is a component of the access token granted to your user ID at logon and changing group membership requires a log out and log in order to get a new access token that reflects the new membership.


9

I'd almost certainly suggest using /usr/local. Globally accessible user scripts can be placed in /usr/local/bin. Small amounts of associated data could also go into bin. Or you may wish to separate out the data into /usr/local/var or /usr/local/share. By doing this you'll be quite sure that anyone FHS familar will be able to locate them pretty quickly ...


9

find /home -not -group test or find /home ! -group test The exclamation inverts the match. From man find: ! expr True if expr is false. This character will also usually need -not expr Same as ! expr, but not POSIX compliant. If you want the group it does belong to in the output: find /home ! -group test -printf "%p:%g\n" ./lots/573:root ...


9

Your understanding is dead on. You could potentially maintain a number of different default address lists based on a user's access level (only letting them have a given group in their list if they're authorized), but that's incredibly ugly and would be nearly impossible to maintain. One way to get rid of the expandability would be to use Dynamic ...


9

This is difficult to perform on a system-wide scale, but possible with individual executable files by killing their process and relaunching them under the user's credentials. When you log on, you receive a token reflecting your group membership, among other things. The only way to refresh this token is to log in.


9

All users: $ getent passwd All groups: $ getent group All groups with a specific user: $ getent group | grep username


9

There is no standard requiring any interoperability meaning of this groups. Traditionally the adm group is used to give a user access to some sort of system log files. See e.g. ls -l /var/log. The sys group normally intended to give a user some kind of administration rights. E.g. archlinux use this group for cups administration. Other distributions behave ...


9

According to the man page (http://linux.die.net/man/8/useradd): UID_MAX (number), UID_MIN (number) Range of user IDs used for the creation of regular users by useradd or newusers. I'm pretty sure that if you set UID_MAX in /etc/login.defs to 5554 you will get the behavior you are looking for.


9

If you only have a single domain and all of your domain controllers are global catalogs, there isn't much impact. Best practice is all domain controllers should be GC's. In large forests with multiple domains, it can be advantageous to limit what groups are universal. This is due to the member attribute of universal groups are replicated to the global ...


8

Adding a user to a group does not effect currently logged in users. In the case of a daemon, you need to restart it for new groups to be applied. Furthermore, restarting the daemon using an option in the daemon itself will not work as that will inherit the current environment. The easiest way to get it to work is to fully stop the daemon and start it ...


8

It wouldn't be recommended to alter the permissions in IIS. You can control Activesync on a user by user basis in the properties of the user account in ADUC. Select the Exchange Features tab and disable the User Intitiated Synchronization feature.


8

pulegium's answer is generally preferred, but if you want a command-line way: sudo dseditgroup -o create mysql (note that creating a group named mysql is probably a bad idea -- there's already a group named _mysql, with mysql as an alias.)


8

The domain admins group, and the AD builtin\Adminstrators group (not the local admin group on clients) effectively grant users in them the same rights, however there are some subtle differences: builtin\administrators is a domain local group, where as domain admins is a global group Domain admins are a memeber of builtin\administrators Domain admins are a ...


8

This can be done through PowerShell $DNOfManager=dsquery user -o dn -name "Testing Tester" $GroupList=dsquery group DC=ad,dc=example,dc=local -limit 600 Foreach ($group in $grouplist) { set-adgroup -Identity $Group -ManagedBy $DNOfManager add-adpermission -Identity $Group -user $DNOfManager -AccessRights ReadProperty, WriteProperty -Properties '...


8

Security groups can be associated with ACLs, whereas distribution groups can't. Both security groups and distribution groups can be mail enabled. http://technet.microsoft.com/en-us/library/cc781446(v=ws.10).aspx


8

You can't delete the 'NT Authority\Authenticated Users' (SID S-1-5-11) group. You also cannot view this group in AD Users and Computers, which would explain why you can't see it using that tool. It's not a "real" security group the way that "DOMAIN\Domain Admins" is, for instance. The membership of "Authenticated Users" is dynamically generated and ...



Only top voted, non community-wiki answers of a minimum length are eligible