Types Of Administrative Responsibility

By Author: yangws
Total Articles: 128
Comment this article

There are two types of administrative responsibility you can CompTIA Security+( http://www.securityplus-sy0-201.com) delegate for an OU:
Full Control for object classes By default, only domain administrators have full control over all objects in a domain. Domain administrators are responsible for creating the initial OU structure, repairing mistakes, and creating additional domain controllers. It is usually sufficient to allow only domain administrators full control over objects in a domain. However, if there are units in the organization that need to determine their own OU structure and administrative models, you can provide them with this permission by delegating full control.
Note For detailed information on delegating administrative control of Active Directory objects, including OUs, refer to Chapter 9, "Administering Active Directory Objects."
When determining whether to delegate full control for an OU, you must determine which areas in the organization need to be allowed to change OU properties and to create, delete, or modify any objects in the SY0-201(http://www.securityplus-sy0-201.com). If more restrictive ...
... control is appropriate, you can accomplish this by delegating control of specific object classes for an OU. Although there are many object classes in the schema, you need to consider only the object classes in which administrators will create objects. Such object classes typically include user account objects, computer account objects, group objects, and OU objects. When determining whether to delegate control of object classes, for each object class that your administrators will create in Active Directory you must determine
Which areas in the organization should be granted full control over objects of this class in the OU
Which areas in the organization should be allowed to create objects of this class and thus have full control over these objects
Which areas in the organization should be allowed to modify only specific attributes for or perform specific tasks pertaining to existing objects of this class.
universal group membership caching A feature in Windows Server 2003 that allows a site that does not contain a global catalog server to be configured to cache universal group memberships for users who log on to the domain controller in the site. This ability allows a domain controller to process user logon requests without contacting a global catalog server when a Microsoftexam (http://www.itcertquick.com) global catalog server is unavail?able. The cache is refreshed periodically as determined in the replication schedule.