Real World Batch Files And Group Membership

By Author: iris
Total Articles: 286
Comment this article

The Ifmember utility is commonly used in batch files and logon scripts to determine sy0-201 security group membership before running a command. You can see how the Ifmember utility works by performing the following steps:
1. Insert the Supplemental CD-ROM and run the \70-294\Labs\Chapter08\Lab8.bat batch file if you have not already. This batch file creates several groups and makes Amy a member of those groups. When the batch file runs, it will leave the commands it runs on-screen for you to review. Press the spacebar when you are finished reviewing what happened.
Run the IfMember_Setup.exe program from the \70-294\Labs\Chapter08 folder on the Supplemental CD-ROM. The Microsoft Web Installation Wizard appears.
3- Click Next to proceed.
4.Read the license agreement. If you do not agree, you cannot continue. If you agree, click the I Agree option button. Then, click Next to proceed. The Destination Directory opens.
5.Adjust the installation location if necessary, and click Install Now.
6.Click Finish.
7.In the new command prompt window, ...
... type comptia security certification and press Enter.
Type notepad c:\membership.txt and press Enter. You'll see a list of your current group memberships displayed in Notepad.
Group scopes allow you to use groups in different ways to assign permissions. The three group scopes are global, domain local, and universal. Global security groups are most often used to organize users who share similar network access requirements. Domain local security groups are most often used to assign permissions to resources. Universal security groups are most often used to assign permissions to related resources in multiple domains.
Use the following strategy for planning groups: place user accounts into global groups, create a domain local groups for a group of resources to be shared in common, place the global groups into the domain local group, and then assign permissions to the domain local group.
The following scope changes are allowed in domains with the domain functional level set to Windows 2000 native or Windows Server 2003: global to universal, as long as the group is not a member of another group having global scope; domain local to universal, as long as the group being converted does not have another group with a domain local scope as its member; universal to global, as long as the group being converted does not have another universal group as its member; and universal to domain local.
You should avoid running your computer while logged on as an administrator because running Windows Server 2003 as an administrator makes the system vulnerable to Trojan horse attacks and other security risks. If you frequently need to log on as an administrator, use the Run As program, which allows you to run specific tools and programs with comptia security permissions other than those provided by the account with which you are currently logged on.