Groups
amart83
Member Posts: 30 ■■□□□□□□□□
You have two domains in the same forest, Domain1.com and Domain2.com
In Domain1, there is a Security Global group called "Training" that is a member of a Domain Local group that has access to a shared folder.
You need to add the domain users from Domain2 to the "Training" Global group in Domain1.
Thoughts?
In Domain1, there is a Security Global group called "Training" that is a member of a Domain Local group that has access to a shared folder.
You need to add the domain users from Domain2 to the "Training" Global group in Domain1.
Thoughts?
Career path: Working on upgrading to MCSA2K3 then MSCE2K3 > CCENT > CCNA
Comments
-
amart83
Member Posts: 30 ■■□□□□□□□□
IMO:
1. In Domain2, create a Security Global Group named "<whatever>"
2. In Domain2, make "<whatever>" a member of the "Domain Users" Domain Local group of Domain2
3. In Domain1, add the "<whatever>" Global group to the members to the "Training" Global group.Career path: Working on upgrading to MCSA2K3 then MSCE2K3 > CCENT > CCNA -
aquageek
Member Posts: 152
dsadd group "ou=AddToTraining,dc=domain1,dc=com" -d domain1.com -u username -p *
dsquery user "ou=everyone,dc=domain1,dc=com" | dsmod group "ou=AddToTraining,dc=domain1,dc=com" -addmbr
dsget group "ou=AddToTraining,dc=domain1,dc=com" -members -d domain1.com -u username -p * | dsmod group "ou=training,dc=domain2,dc=com" -addmbr -d domain2.com -u username -p *
?You are the systems administrator for a large enterprise that has decided to place computers in the lobby for access to public company information. On Tuesday morning Rooslan storms into your office screaming, "what the hell is this? In the last question I was the systems administrator. Now I am only a "Backup Operator"? This **** is crazy!" -
aquageek
Member Posts: 152
I would like to retract my previous answer and submit the following:dsadd group "cn=AddToTraining,dc=domain1,dc=com" -d domain1.com -u username -p *
dsquery user "dc=domain1,dc=com" | dsmod group "cn=AddToTraining,dc=domain1,dc=com" -addmbr
dsget group "ou=AddToTraining,dc=domain1,dc=com" -members -d domain1.com -u username -p * | dsmod group "cn=training,dc=domain2,dc=com" -addmbr -d domain2.com -u username -p *
That's my final answer.You are the systems administrator for a large enterprise that has decided to place computers in the lobby for access to public company information. On Tuesday morning Rooslan storms into your office screaming, "what the hell is this? In the last question I was the systems administrator. Now I am only a "Backup Operator"? This **** is crazy!" -
dynamik
Banned Posts: 12,312 ■■■■■■■■■□
IMO:
1. In Domain2, create a Security Global Group named "<whatever>"
2. In Domain2, make "<whatever>" a member of the "Domain Users" Domain Local group of Domain2
3. In Domain1, add the "<whatever>" Global group to the members to the "Training" Global group.
For step 2, you're going to want to make domain users a member of <whatever>.
The problem with scripting it is that you'll have to update it manually whenever users are added or removed. There's already a group that matches his criteria, so why make things more complicated than they need to be? -
aquageek
Member Posts: 152
The problem with scripting it is that you'll have to update it manually whenever users are added or removed. There's already a group that matches his criteria, so why make things more complicated than they need to be?
That's true, but the question doesn't explicitly require that all future domain2 users be added to the training group.
If you wanted to stop people automatically being added to the training group you'd have to manually remove them as a member each time.
Right? (I'm asking for my own edification)You are the systems administrator for a large enterprise that has decided to place computers in the lobby for access to public company information. On Tuesday morning Rooslan storms into your office screaming, "what the hell is this? In the last question I was the systems administrator. Now I am only a "Backup Operator"? This **** is crazy!" -
dynamik
Banned Posts: 12,312 ■■■■■■■■■□
That's true, but the question doesn't explicitly require that all future domain2 users be added to the training group.
Are you an MS exam writer?
If you wanted to stop people automatically being added to the training group you'd have to manually remove them as a member each time.
In my scenario? That would require removing them from the domain users group, which is probably not what you'd want to do. If you needed more granular control over who was a member, you should probably do something like what you did. -
aquageek
Member Posts: 152
You are the systems administrator for a large enterprise that has decided to place computers in the lobby for access to public company information. On Tuesday morning Rooslan storms into your office screaming, "what the hell is this? In the last question I was the systems administrator. Now I am only a "Backup Operator"? This **** is crazy!"
-
puertorico123
Member Posts: 95 ■■□□□□□□□□
You have two domains in the same forest, Domain1.com and Domain2.com
In Domain1, there is a Security Global group called "Training" that is a member of a Domain Local group that has access to a shared folder.
You need to add the domain users from Domain2 to the "Training" Global group in Domain1.
Thoughts?
1. In Domain2, create a Security Universal Group named "<to be trainnng>"
2. In Domain1, upgrade "Training" group to Universal.
3. In Domain1, add the "<To be training>" universal group to the members to the "Training" universal group.
is good?HOLD:
Comptia A+
Comptia Network+
2009 Plan:
MCSA...75%
CCENT....0%
70-648..0%
2010 Plan:
MCITP
ORACLE -
dynamik
Banned Posts: 12,312 ■■■■■■■■■□
Is the "domain users" group a domain local group in Server 2003 (I missed that part the first time around)? I only have 2008 available atm, and it shows it's a global group. If it is a domain local group that would be problematic since global groups can only contain accounts and other global groups.
Group scope: Active Directory -
amart83
Member Posts: 30 ■■□□□□□□□□
In 2003, "Domain Users" is a Domain Local group.Is the "domain users" group a domain local group in Server 2003 (I missed that part the first time around)? I only have 2008 available atm, and it shows it's a global group. If it is a domain local group that would be problematic since global groups can only contain accounts and other global groups.
Group scope: Active Directory
Yes, you're right. Thank you!For step 2, you're going to want to make domain users a member of <whatever>.
But I have the right idea?Career path: Working on upgrading to MCSA2K3 then MSCE2K3 > CCENT > CCNA -
dynamik
Banned Posts: 12,312 ■■■■■■■■■□
Well, if that's the case, you're going to have to do something like aquageek suggested since you can't have a domain local group from another domain nested in any other group. It shows up as a global group in 2003 R2 as well.
-
amart83
Member Posts: 30 ■■□□□□□□□□
In my lab, I was successfuly able to make the "Domain Users" a member of "<whatever>" Global group.
But I don't have that 2nd Domain in my lab to verify if this is possible.Career path: Working on upgrading to MCSA2K3 then MSCE2K3 > CCENT > CCNA -
dynamik
Banned Posts: 12,312 ■■■■■■■■■□
You can't make domain local groups members of global or universal groups. They can only be members of other domain local groups in the same domain. Check that link I posted. Are you sure domain users isn't a global group?
-
amart83
Member Posts: 30 ■■□□□□□□□□
Dude, you're right. Sorry. Could've sworn I saw Domain Local before...You can't make domain local groups members of global or universal groups. They can only be members of other domain local groups in the same domain. Check that link I posted. Are you sure domain users isn't a global group?
Career path: Working on upgrading to MCSA2K3 then MSCE2K3 > CCENT > CCNA -
dynamik
Banned Posts: 12,312 ■■■■■■■■■□
No worries. I wasn't trying to be picky or anything; it's just that it does make a significant difference in this situation.
