Changing Inherited Permissions

By Author: Anny Brwon
Total Articles: 58
Comment this article

There are three ways to make changes to inherited permissions:

Make the changes to the parent object, and then the object inherits these permissions.

Assign the opposite permission (Allow or Deny) to the security principal to over?

ride the inherited permission.

Clear the Allow Inheritable Permissions From The Parent To Propagate To This

Object And All CompTIA
Objects. Include These With Entries Explicitly Defined Here

check box in the Advanced Security Settings dialog box for the object. Then, you

can make changes to the permissions or remove users or groups from the Permissions Entries list. However, the object no longer inherits permissions from the parent object.

Selective Authentication

In Chapter 4, "Installing and Managing Domains, Trees, and Forests," you learned that in Windows Server 2003, you can determine the scope of authentication between two domains that are joined by an external trust or a forest trust. Recall that an external trust must be explicitly created by a systems administrator ...
... between Windows Server 2003 domains that are in different forests or between a Windows Server 2003 domain and a domain whose domain controller is running Windows NT 4 or earlier. The trust is non-transitive. A forest trust is explicitly created by a
certification provider
between two forest root domains. The trust is transitive between two forests only. Both trusts can be one- or two-way.

You can set selective authentication differently for outgoing and incoming external and forest trusts. These selective trusts allow you to make flexible access control decisions between external domains and forest-wide.

If you use domain-wide authentication on the incoming external or forest trust, users in the second domain or
free practice exam questions
would have the same level of access to resources in the local domain or forest as users who belong to the local domain or forest. For example, if DomainA has an incoming external trust from DomainB and domain-wide authentication is used, any user from DomainB would be able to access any resource in DomainA (assuming that they have the required permissions). Simi?larly, if ForestA has an incoming forest trust from ForestB and forest-wide authentica?tion is used, any user from ForestB "would be able to access any resource in ForestA (assuming they have the required permissions).

If you set selective authentication on an incoming external or forest trust, you need to manually assign permissions on each resource to which you want users in the second domain or forest to have access. To do this, set the Allowed To Authenticate permission on an object for that particular user or group from the external domain or forest.