Administering The Active Directory Objects

By Author: Jasmine
Total Articles: 286
Comment this article

You set permissions to either Allow or Deny. Deny permissions take precedence over all other Security+ certification permissions. For example, if you deny permission to a user to gain access to an object, the user will not have that permission, even if you allow the permission for a group of which the user is a member. The object type determines which permissions you can select. For example, you can assign the Reset Password permission to a security principal for a user object but not for a printer object. For each object type, there is a group of standard permissions and a group of more detailed special permissions.
Standard permissions are the most frequently assigned. You can view the standard permissions in the Security tab in the Properties dialog box for an object, shown in Figure 9-6.
To view the standard permissions for an object, complete the following steps:
1. Click Start, point to Administrative Tools, and then click Active Directory Users And Computers. On the View menu, ensure that Advanced Features is selected. Right-click the object for which ...
... you want to view standard permissions and click Properties.
In the Properties dialog box for the object, click the Security+ benefits. Click the appropriate security principal in the Group Or User Names box to view the assigned standard permissions.
Important You must select Advanced Features on the View menu to be able to access the Security tab.
Table 9-3 lists the basic standard permissions that are available for most objects (some object types have additional standard permissions) and the type of access that each permission allows.
Standard permissions are composed of special permissions, which provide you with a finer degree of control for assigning access to objects. For example, the standard Write permission is composed of the Write All Properties and All Validated Writes special permissions. Special permissions are also referred to as advanced security settings. You can view the special permissions in the Permission Entry dialog box for an object, shown in Figure 9-7.
The saved queries feature enables administrators to create, edit, save, organize and e-mail saved queries in order to monitor or perform a specific task on direc?tory objects. Saved queries are stored in the Saved Queries container in the Active Directory Users And Computers console. Saved queries can be exported to an .xml file and imported free comptia security+ exam into other Active Directory Users And Computers consoles located on Windows Server 2003 domain controllers in the same domain.