Re: Domian local group versus Domain admin group

From: Roger Abell (mvpNOSpam_at_asu.edu)
Date: 08/29/05

  • Next message: webappsec_at_gmail.com: "Preventing Log Evasion in IIS" 
    Date: Sun, 28 Aug 2005 17:36:05 -0700

    The best docs for comprehensive view of what is there and some
    issues for usage is the resource kit. Check out
    www.reskit.com
    Opinions differ as to when use of domain global vs domain local
    is a correct choice. Either are available for use on any machine in
    the domain. They of course have potentially significant differences
    in a multi-domain forest, as globals can contain only objects from
    their own domain - a limitation locals do not have. The user token
    contains info on all memberships of the account, and has a limited
    size, and as globals have a smaller representation the token can
    hold info about more group memberships is globals are used.
    Those are some factors, but the pros and cons do not alway give
    a clear winner as to a best practice - but again, in a single domain
    forest (that will always be so) locals seem to hold little advantage,
    whereas if the opposite is true globals can be a risky thing to use
    directly across members of the domain (risking potential future
    need to change the members). 

    -- 
Roger Abell
Microsoft MVP (Windows  Security)
MCSE (W2k3,W2k,Nt4)  MCDBA
"Darren" <Darren@somewhere.com.(donotspam)> wrote in message
news:%23Hqffq$qFHA.3788@TK2MSFTNGP12.phx.gbl...
> Thanks . Roger
> Just want to make sure I understand the diffrences . I am just curious to
> know whats the use of Domain local group and when would you use domain
local
> groups perhaps some examples..
> Are there articles on Microsoft site that explain group membership usage
and
> best practises etc....
>
> Thanks
> Darren
> "Roger Abell" <mvpNOSpam@asu.edu> wrote in message
> news:%23%23BxDg3qFHA.3788@TK2MSFTNGP12.phx.gbl...
> > Domain Local is a type of group, not a group itself.
> > Domain local groups can contain members from other domains.
> > Domain global groups by contrast can only contain as members
> > objects that are defined in the group's domain.
> >
> > Domain admins is a group.  It is a domain global group.  By
> > default Domain Admins is a member in the Administrators group
> > on every machine in its domain (this is changable).
> >
> > -- 
> > Roger Abell
> > Microsoft MVP (Windows  Security)
> > MCSE (W2k3,W2k,Nt4)  MCDBA
> > "Darren" <Darren@somewhere.com> wrote in message
> > news:ujged1xqFHA.3660@TK2MSFTNGP15.phx.gbl...
> >> what are the diffrences amoung groups Domain Local and Domain Admin..
> >>
> >> Thanks
> >> Darren
> >>
> >>
> >
> >
>
>
  • Next message: webappsec_at_gmail.com: "Preventing Log Evasion in IIS"

    Relevant Pages

    • How to make global data thread safe ? Please Help...
      ... I have a public static class with public static members (different ... I have a worker function which is called asynchronously (so that there ... will write the entire set of globals when given control through a GUI ... accessing any of the global members and the writer function is called, ...
      (microsoft.public.dotnet.framework)
    • Re: Global application variables in WinForms app
      ... Use a class with static members. ... class Globals ... > mean override routines in every single form. ... > Looking on Google I could only find items relating to WebForms, ...
      (microsoft.public.dotnet.languages.csharp)
    • Re: How do I do this? (eval() on the left hand side)
      ... Nick Coghlan wrote: ... could you please comment on why you say this about globals()? ... I'm a devoted follower of the Pythonic principle of 'explicit is better ... used this->name to reference C++ members despite the fact that 'this' ...
      (comp.lang.python)
    • Re: Should Globally Needed Objects be Members in Main Frame, Application, or be Global?
      ... maintenance in your work environment. ... I do like the g_ syntax for globals, ... but I'd assume those would be statically global, not members of a class. ...
      (microsoft.public.vc.mfc)