Controlling Access To Active Directory Objects

By Author: kayla
Total Articles: 127
Comment this article

The Windows Support Tools include the IT certification(http://www.buyitexam.com) and SDCheck utility, introduced in Chap¬ter 3. You can use this utility to diagnose permission inheritance and permission replication issues. For example, if you run the command sdcheck serverl administrator@contoso.com, you'll receive a list of permissions assigned to the Administrator account of the con-toso.com domain according to Serverl. If you run the command sdcheck server2 admin-istrator@contoso.com, you'll see the same output according to Server2. You can compare the two results in an attempt to locate a discrepancy. In order to make the comparison more easily, you can use a file comparison utility, such as Windiff.exe, which is also part of the Windows Support Tools. In that case, you'd ensure the output of the SDCheck commands went to a file by adding > filename.txt to the end of the command. If you find a discrepancy, this may be an indication that there is something wrong with the replication process. For additional examples of how to use SDCheck, perform a Web search on "SDCheck examples."

For example, as shown in Figure ...
... 9-8, if you assign Full Control permission to the Sales group for the Fast OU, the permission can be propagated to the free CompTIA practice tests(http://www.examshots.com/vendor/CompTIA-4.html) of the East OU, the Chicago and Columbus OUs, and their respective child objects, a shared folder named Account Information, and two users. Therefore, permissions for the Sales group in the East OU are explicit permissions, while the permissions for the Sales group in the OUs, shared folder, and users are inherited permissions.
Permissions set for the parent objects can be inherited by child objects.

After you set permissions on a parent object, child objects created in the parent object can inherit these permissions. There are three indicators of inherited permissions:
Shaded permissions check boxes These check boxes are located in the Secu¬rity tab in the Properties dialog box for an object, shown previously in Figure 9-6, and in the Permission Entry dialog box for an object, shown previously in Figure 9-7.

If a permission is inherited, a permissions check box is shaded. However, shaded special permissions check boxes do not indicate inherited permissions. These shaded check boxes merely indicate that a special permission exists.
The Inherited From column This column is located in the Permission Entries list in the Advanced Security Settings dialog box for an object, shown in Figure 9-9-If a permission is inherited, the distinguished name of the parent object is dis¬played. This is a new feature in Windows Server 2003.
Unavailable Remove button for a permission This button is located in the Advanced Security Settings dialog box, shown in Figure 9-9- If a permission is inherited, the Remove button is unavailable, because the permission must be removed at the parent object.

After you set permissions on a parent object, child objects created in the parent object can inherit these permissions. There are three indicators of inherited permissions:
Shaded permissions check boxes These check boxes are located in the Secu¬rity tab in the Properties dialog box for an object, shown previously in Figure 9-6, and in the Permission Entry dialog box for an object, shown previously in Figure 9-7.

The Inherited From column of 70-299 Exam(http://www.mcse-70-299.com) is located in the Permission Entries list in the Advanced Security Settings dialog box for an object, shown in Figure 9-9-If a permission is inherited, the distinguished name of the parent object is dis¬played. This is a new feature in Windows Server 2003.Unavailable Remove button for a permission This button is located in the Advanced Security Settings dialog box, shown in Figure 9-9- If a permission is inherited, the Remove button is unavailable, because the permission must be removed at the parent object.