Tag Info

Hot answers tagged

22

Assuming all your Domain Controllers are Windows Server 2003 or later you can do this with native Active Directory's dynamic objects functionality without any scripting. Let's say that a user account, "Bob", needs to be in the "Accounting" group for 24 hours. Create a "Bob in Accounting 24 Hours" group and specify an entry-TTL for 24 hours (the duration ...


17

When adding a user to a new group, the user must log out and log back in for it to take affect. While a reboot will accomplish that, it should not be required.


14

Michael's answer was the closest, but I wanted to be sure, so I installed a fresh copy of Ubuntu Server 8.04.2 (Hardy Heron) in a virtual machine to get the official group list. The installation was a basic one with no specific server roles selected. These are the first groups, assigned by default, to the first user: $USERNAME (e.g. wayne) (primary group ...


14

"System preferences" -> "Accounts" -> "+" (as if you were adding new account) -> Under "New account" select "Group" -> Type in group name -> "Create group"


13

I was looking for a solution, came across this post, and then later found one! I'd thought I'd actually offer a solution so others can benefit. Logging in and out is so 1995. Taken from: https://arkaitzj.wordpress.com/2010/03/08/linux-add-user-to-a-group-without-logout/ So if you needed to get permissions for the cdrom group you just added your user to: ...


13

FreeIPA is probably what you're looking for. It's to Linux what Active Directory is to Windows. (It can also talk to AD if you have a heterogeneous environment, but shouldn't be used to manage Windows machines directly. Use AD for that.) Red Hat's documentation (they call it Identity Management) is very thorough and easy to follow, and should be mostly ...


11

Besides AuthLDAPSubGroupDepth, that is available only in apache 2.4, it is possible, when using Microsoft AD LDAP, to do authorization using nested groups by using LDAP_MATCHING_RULE_IN_CHAIN matching rule. This is much faster than searching subgroups on the client, because it is done on the DC server with less queries over network. Require ldap-filter ...


10

You need to set AuthLDAPSubGroupDepth to make this work. The integer you provide here specifies the maximum sub-group nesting depth that will be evaluated before the user search is discontinued. Add this to your config: AuthLDAPSubGroupDepth 1 More Info: here and here.


10

Gimme the codes! powers, activate! $Groups = Get-ADGroup -Properties * -Filter * -SearchBase "OU=Groups,DC=corp,DC=ourcompany,DC=Com" Foreach($G In $Groups) { Write-Host $G.Name Write-Host "-------------" $G.Members } The point being, just take your time and break it out into steps. I know that it's fun to try to get everything and the ...


8

It wouldn't be recommended to alter the permissions in IIS. You can control Activesync on a user by user basis in the properties of the user account in ADUC. Select the Exchange Features tab and disable the User Intitiated Synchronization feature.


8

This can be done through PowerShell $DNOfManager=dsquery user -o dn -name "Testing Tester" $GroupList=dsquery group DC=ad,dc=example,dc=local -limit 600 Foreach ($group in $grouplist) { set-adgroup -Identity $Group -ManagedBy $DNOfManager add-adpermission -Identity $Group -user $DNOfManager -AccessRights ReadProperty, WriteProperty -Properties ...


8

Your understanding is dead on. You could potentially maintain a number of different default address lists based on a user's access level (only letting them have a given group in their list if they're authorized), but that's incredibly ugly and would be nearly impossible to maintain. One way to get rid of the expandability would be to use Dynamic ...


8

You can't delete the 'NT Authority\Authenticated Users' (SID S-1-5-11) group. You also cannot view this group in AD Users and Computers, which would explain why you can't see it using that tool. It's not a "real" security group the way that "DOMAIN\Domain Admins" is, for instance. The membership of "Authenticated Users" is dynamically generated and ...


7

I'd almost certainly suggest using /usr/local. Globally accessible user scripts can be placed in /usr/local/bin. Small amounts of associated data could also go into bin. Or you may wish to separate out the data into /usr/local/var or /usr/local/share. By doing this you'll be quite sure that anyone FHS familar will be able to locate them pretty quickly ...


7

Adding a user to a group does not effect currently logged in users. In the case of a daemon, you need to restart it for new groups to be applied. Furthermore, restarting the daemon using an option in the daemon itself will not work as that will inherit the current environment. The easiest way to get it to work is to fully stop the daemon and start it ...


7

You don't. There has to be a trust between the computer and the domain (aka joining the computer to the domain) to be able to authenticate domain users locally. Now for something practical: You have two options 1) create a local user with the same username and password as the domain user, and add that local user to the local group. 2) Join the machine ...


7

The domain admins group, and the AD builtin\Adminstrators group (not the local admin group on clients) effectively grant users in them the same rights, however there are some subtle differences: builtin\administrators is a domain local group, where as domain admins is a global group Domain admins are a memeber of builtin\administrators Domain admins are a ...


7

This isn't possible. When you log on, you receive a token reflecting your group membership, among other things. The only way to refresh this token is to log in.


7

What you are seeing is normal and expected behaviour. The x bit is required on a directory to enter it, search through it, or execute a program in it. As you are trying to cd into the directory then without the x bit being set you can't. When you set the permissions to 744, your user world who is the owner of the directory then has full control and as you ...


7

Assuming the jumpbox is a linux box, iptables can usefully be used on the OUTPUT chain to restrict which group members can connect to which servers. Something like iptables -A OUTPUT --gid-owner project1 -p tcp --dport 22 -d ip.of.project1.com -j ACCEPT iptables -A OUTPUT --gid-owner project1 -j REJECT iptables -A OUTPUT --gid-owner project2 -p tcp --dport ...


7

There is no standard requiring any interoperability meaning of this groups. Traditionally the adm group is used to give a user access to some sort of system log files. See e.g. ls -l /var/log. The sys group normally intended to give a user some kind of administration rights. E.g. archlinux use this group for cups administration. Other distributions behave ...


7

What you're seeing is the SID (Security Identifier) of an object. Generally, Windows is nice enough to automatically translate this SID into a user's display name for you in the Security dialog, so that you don't have to hunt for it, but if a Domain Controller is unable to be contacted when the ACL is being viewed, you'll see a SID. You'll also see this SID ...


7

Extend your Get-ADUser line: $getmembership = Get-ADUser $User -Properties MemberOf | Select -ExpandProperty memberof | Get-ADGroup -Properties name | Where { $_.GroupCategory -eq 'Security' } | Select -ExpandProperty Name This will feed the DN of the Group to Get-ADGroup to retrieve additional properties, then filter on group category and select the name ...


6

You can create a file containing the list of usernames, etc., and use the newusers command. It wants the file to look like the format of /etc/passwd with a few exceptions, one is that the password is plain text (newusers encrypts it). newusers userfile.txt It doesn't handle multiple groups, though.


6

pulegium's answer is generally preferred, but if you want a command-line way: sudo dseditgroup -o create mysql (note that creating a group named mysql is probably a bad idea -- there's already a group named _mysql, with mysql as an alias.)


6

As Gordon Davisson notes, standard Mac OS X 10.6 already has a mysql group, as this command shows: dscl . -read /Groups/mysql You shouldn’t create your own mysql group, and any attempts to modify it will affect the _mysql group. But to answer your question, the most succinct way to do it would be this single command: dscl . -create /Groups/mysql gid 296 ...


6

Before a Domain Controller is promoted to that role, it is a simple workgroup (standalone) server and has a local Administrator account and a local Administrators group. When you create a domain, those accounts don't go away; they're incorporated into the domain as the domain Administrator account and the domain builtin\Administrators group. The ...


6

That don't have any effect on folder shares. Groups are identified by SID which doesn't change if you change group name. If you go to that folder share and take a look at security tab, then you might see old group name there, but it doesn't matter.


6

Group membership is determined on login. Log out, and then log back in.


6

It looks like your only option in Apache 2.2 is to list every group that is included by your main authorized group. Require ldap-group CN=MySpecificGroup,OU=Security Groups,OU=MyBusiness,DC=company,DC=local Require ldap-group CN=MyOtherGroup,OU=Security Groups,OU=MyBusiness,DC=company,DC=local This should be reasonable if your nested groups aren't too ...



Only top voted, non community-wiki answers of a minimum length are eligible