If you have folders like SuperiorFolder and Sub1, Sub2, Sub3, Sub4, Sub5 folders under this.

And you have Group1, Group2, Group3, Group4, Group5 who shall have access to different rights among these folders.

Is the best practice to create Global Groups (Security) for the different categories you find? Like Global Group 1, Global Group2 , Global Group 3, Global Group 4, Global Group 5.

And then you create Domain Local Groups (Security) like Sub1_full, Sub1_read Sub2_full, Sub2_modify, Sub3_full, Sub4_read, Sub5_write etc.

And of course add the different users to the correct Group and add the domain local group to the ACL adjust the NTFS.

And open up the share rights with full and lock down with NTFS.

Is this the best practice for doing this on Domain Server 2003 for giving different rights to different users on catalogs?

  • 1
    Don't worry about best practices. Make sure you fully understand the ACL system and it's implications and then create a permission scheme that makes your requirement possible. – Sven May 13 '13 at 11:33
  • Ok from what you see, does it look ok to you to do like this? – Chris_45 May 13 '13 at 11:36

There are best practices like nesting global groups into domain local groups on the file server and then applying only local groups to shares and NTFS permissions, yes. This dates back to Win2000 days: Best Practices for Groups

However, like SvW commented, nowadays it really boils down to your environment, requirements, and often your own IT experience of "that's how I've always done it."

For instance, for myself I tend to always do the following:

SHARES = Domain Admins get Full, Everyone gets Read/Write

Then I lock down rights at the NTFS level of the share, based on domain local groups named appropriately. I may or may not create global groups to nest into the domain local group. I typically use domain local groups since they can have remote trusted domain groups in them, making it easier in the future in a multi-forest environment.

Sub-folders that have to break inheritance for some reason might get unique groups as well. Other times I will be lazy and simply add 2 or 3 domain users directly to a share.

Sometimes I will even create local groups directly on the server, put domain users/groups in that server local group and apply that to a share.

But YMMV, and others may not like the way I do it. My advice is to create an environment that is easy to understand, manage, and hand off to a teammate or your eventual replacement.

  • Ok thanx. So you mean its a bit of "overkill" to do the Global Groups for different kinds of personal? I know always context but your generic answer? But "big" point to skip that to make it understandable for teammates. – Chris_45 May 13 '13 at 17:46
  • Not sure what you are asking, but in a single domain/forest environment you can get by with just global groups. If you have or think you'll have multi-forest trusts in place, it is best to use domain local groups (or universal groups) at the NTFS level so that you can simply add remote forest users/groups to those domain local groups in AD and not mess with applying them at the NTFS security tab. – TheCleaner May 13 '13 at 18:06
  • Ok you mean it will be enough with Domain Local Groups (Security) like Sub1_read, Sub2_modify, Sub3_write and so on. And then put users in these DL Groups? – Chris_45 May 13 '13 at 18:19
  • Sure...or you can create Global Groups and put the users in there and apply the global group to the NTFS permissions (on a single domain). Since groups default to Global security groups, a lot of places simply use Global groups for everything. Read down near the bottom of that link on when to use each group for Best Practices, but don't sweat it too much... – TheCleaner May 13 '13 at 18:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.