Hot answers tagged

22

Assuming all your Domain Controllers are Windows Server 2003 or later you can do this with native Active Directory's dynamic objects functionality without any scripting. Let's say that a user account, "Bob", needs to be in the "Accounting" group for 24 hours. Create a "Bob in Accounting 24 Hours" group and specify an entry-TTL for 24 hours (the duration ...


21

"System preferences" -> "Accounts" -> "+" (as if you were adding new account) -> Under "New account" select "Group" -> Type in group name -> "Create group"


19

I was looking for a solution, came across this post, and then later found one! I'd thought I'd actually offer a solution so others can benefit. Logging in and out is so 1995. Taken from: https://arkaitzj.wordpress.com/2010/03/08/linux-add-user-to-a-group-without-logout/ So if you needed to get permissions for the cdrom group you just added your user to: ...


19

Besides AuthLDAPSubGroupDepth, that is available only in apache 2.4, it is possible, when using Microsoft AD LDAP, to do authorization using nested groups by using LDAP_MATCHING_RULE_IN_CHAIN matching rule. This is much faster than searching subgroups on the client, because it is done on the DC server with less queries over network. Require ldap-filter ...


18

When adding a user to a new group, the user must log out and log back in for it to take affect. While a reboot will accomplish that, it should not be required.


18

There's two parts to this question: when to add a new FILEGROUP, and when to add a new FILE in a filegroup. First let's talk theory: Mark's right about the primary reason being performance. The secondary reason is disaster recovery. With SQL Server 2005 and newer, you can do filegroup restores. When disaster strikes, you can restore just your primary ...


16

Gimme the codes! powers, activate! $Groups = Get-ADGroup -Properties * -Filter * -SearchBase "OU=Groups,DC=corp,DC=ourcompany,DC=Com" Foreach($G In $Groups) { Write-Host $G.Name Write-Host "-------------" $G.Members } The point being, just take your time and break it out into steps. I know that it's fun to try to get everything and the ...


15

The basic rule of thumb is to separate files onto different volumes to avoid contention, however the anmount of performance gain you get varies wildly by I/O subsystem and workload. For instance, multiple files on a single physical spindle is going to suck as far as performance goes, but the same arrangement with the volume being on a SAN LUN with several ...


14

Michael's answer was the closest, but I wanted to be sure, so I installed a fresh copy of Ubuntu Server 8.04.2 (Hardy Heron) in a virtual machine to get the official group list. The installation was a basic one with no specific server roles selected. These are the first groups, assigned by default, to the first user: $USERNAME (e.g. wayne) (primary group ...


14

FreeIPA is probably what you're looking for. It's to Linux what Active Directory is to Windows. (It can also talk to AD if you have a heterogeneous environment, but shouldn't be used to manage Windows machines directly. Use AD for that.) Red Hat's documentation (they call it Identity Management) is very thorough and easy to follow, and should be mostly ...


13

You need to set AuthLDAPSubGroupDepth to make this work. The integer you provide here specifies the maximum sub-group nesting depth that will be evaluated before the user search is discontinued. Add this to your config: AuthLDAPSubGroupDepth 1 More Info: here and here.


12

I've used these to add dba group: sudo dscl . -create /groups/dba sudo dscl . -append /groups/dba gid 4200 sudo dscl . -append /groups/dba passwd "*"


11

This is how this works: When you login via FTP/SSH and upload files, they are created with your permissions. Probably your webroot is world writable (0777), that is insecure - every user in system can write something there. PHP runs with different user privileges (They are specified in PHP-FPM config, not nginx config), and as directory is world writable, ...


9

When you added yourself to the group, did you log out of your workstation and log back in? Security Group membership is a component of the access token granted to your user ID at logon and changing group membership requires a log out and log in order to get a new access token that reflects the new membership.


9

find /home -not -group test or find /home ! -group test The exclamation inverts the match. From man find: ! expr True if expr is false. This character will also usually need -not expr Same as ! expr, but not POSIX compliant. If you want the group it does belong to in the output: find /home ! -group test -printf "%p:%g\n" ./lots/573:root ...


9

You don't. There has to be a trust between the computer and the domain (aka joining the computer to the domain) to be able to authenticate domain users locally. Now for something practical: You have two options 1) create a local user with the same username and password as the domain user, and add that local user to the local group. 2) Join the machine ...


9

Your understanding is dead on. You could potentially maintain a number of different default address lists based on a user's access level (only letting them have a given group in their list if they're authorized), but that's incredibly ugly and would be nearly impossible to maintain. One way to get rid of the expandability would be to use Dynamic ...


9

This is difficult to perform on a system-wide scale, but possible with individual executable files by killing their process and relaunching them under the user's credentials. When you log on, you receive a token reflecting your group membership, among other things. The only way to refresh this token is to log in.


9

According to the man page (http://linux.die.net/man/8/useradd): UID_MAX (number), UID_MIN (number) Range of user IDs used for the creation of regular users by useradd or newusers. I'm pretty sure that if you set UID_MAX in /etc/login.defs to 5554 you will get the behavior you are looking for.


8

You can't delete the 'NT Authority\Authenticated Users' (SID S-1-5-11) group. You also cannot view this group in AD Users and Computers, which would explain why you can't see it using that tool. It's not a "real" security group the way that "DOMAIN\Domain Admins" is, for instance. The membership of "Authenticated Users" is dynamically generated and ...


8

This can be done through PowerShell $DNOfManager=dsquery user -o dn -name "Testing Tester" $GroupList=dsquery group DC=ad,dc=example,dc=local -limit 600 Foreach ($group in $grouplist) { set-adgroup -Identity $Group -ManagedBy $DNOfManager add-adpermission -Identity $Group -user $DNOfManager -AccessRights ReadProperty, WriteProperty -Properties ...


8

Security groups can be associated with ACLs, whereas distribution groups can't. Both security groups and distribution groups can be mail enabled. http://technet.microsoft.com/en-us/library/cc781446(v=ws.10).aspx


8

The domain admins group, and the AD builtin\Adminstrators group (not the local admin group on clients) effectively grant users in them the same rights, however there are some subtle differences: builtin\administrators is a domain local group, where as domain admins is a global group Domain admins are a memeber of builtin\administrators Domain admins are a ...


8

pulegium's answer is generally preferred, but if you want a command-line way: sudo dseditgroup -o create mysql (note that creating a group named mysql is probably a bad idea -- there's already a group named _mysql, with mysql as an alias.)


8

It wouldn't be recommended to alter the permissions in IIS. You can control Activesync on a user by user basis in the properties of the user account in ADUC. Select the Exchange Features tab and disable the User Intitiated Synchronization feature.


8

Adding a user to a group does not effect currently logged in users. In the case of a daemon, you need to restart it for new groups to be applied. Furthermore, restarting the daemon using an option in the daemon itself will not work as that will inherit the current environment. The easiest way to get it to work is to fully stop the daemon and start it ...


8

I'd almost certainly suggest using /usr/local. Globally accessible user scripts can be placed in /usr/local/bin. Small amounts of associated data could also go into bin. Or you may wish to separate out the data into /usr/local/var or /usr/local/share. By doing this you'll be quite sure that anyone FHS familar will be able to locate them pretty quickly ...


7

Before a Domain Controller is promoted to that role, it is a simple workgroup (standalone) server and has a local Administrator account and a local Administrators group. When you create a domain, those accounts don't go away; they're incorporated into the domain as the domain Administrator account and the domain builtin\Administrators group. The ...


7

For Windows 2008 and higher: psexec -s -i -d cmd.exe C:\Windows\system32>whoami nt authority\system -- List the session 0 tickets (0x3e7 is the machine session 0) klist -lh 0 -li 0x3e7 -- Purge the session 0 tickets klist -lh 0 -li 0x3e7 purge Should display: Current LogonId is 0:0x3e7 Deleting all tickets: Ticket(s) ...


7

Easiest way to do it would be to set the directory's group to the group you want, and then set the sticky group bit on the directory with chmod g+s.



Only top voted, non community-wiki answers of a minimum length are eligible