How The Group Membership Affects Access Control

By Author: Jasmine
Total Articles: 286
Comment this article

A security principal can be a member ofwindows 7 enterprise desktop support technician multiple groups, each with different permissions, that provide different levels of access to objects. When you assign a permission to a security principal for access to an object and that security principal is a member of a group to which you assigned a different permission, the security principal's permissions are the combination of the security principal and group permissions. For example, if a user as an individual has Read permission and is a member of a group with Write permission, the user has both Read and Write permission. When assigning permissions to groups, you must determine which users are affected.

To view the special permissions for an object, complete the following steps:
1.Click Start, point to Administrative Tools, and then click Active Directory Users And Computers. On the View menu, ensure that Advanced Features is selected.
Right-click the object for -which you want to view special permissions, and then click Properties.
2.In the Properties dialog box for the object, click the mcitp ...
... Security tab. Click Advanced.
3.In the Advanced Security Settings dialog box for the object, select the appropriate security principal and permission in the Permission Entries list, and then click Edit.
In the Permission Entry dialog box for the object, select the Object tab to view special permissions for the object assigned to the security principal. Select the Properties tab to view special permissions for the properties assigned to the security principal.
Off the Record As introduced in Chapter 3, "Administering Active Directory," Acldiag.exe and Dsacls.exe are Windows Support Tools that you can use to view and edit Active Directory permissions. For example, if you want to see all of the permissions assigned to an OU named Marketing in the contoso.com domain, you could type acldiag ou=marketing,dc=con-toso,dc=com. The resulting output would be a complete dump of the discretionary access control list (DACL) of the Marketing OU, including a list of special permissions.
There are two ways to locate Active Directory objects: 1) use the Find option on the Active Directory Users And Computers console, and 2) use the Dsquery command.
The Dsquery command-line 70-685 tool enables you to find computers, contacts, subnets, groups, OUs, sites, servers, and users in Active Directory according to criteria you specify.