70-640 Active Directory

Front 1

AD DS
IDA

Back 1

AD DS - Active Directory Domain Services

IDA - identity and access

Front 2

What AD DS provides?

Back 2

the functionality of an IDA solution for enterprise networks

Front 3

What is IDA?

Back 3

IDA infrastructure refers to the tools and core technologies used to integrate, people, processes and technology in an organization

Front 4

Where AD DS stores enterprise-wide IDA information ?

Back 4

in a DB called Active directory data store
It contains all the info on all objects that exist within the AD infrastructure

Front 5

SID
TGT
DACL

Back 5

SID - security identifier
TGT - ticket granting ticket
DACL - discretionary access control list

Front 6

Authentication

Back 6

An entity must first verify its identity to AD infrastructure before being granted the ability to func as part of AD domain

Front 7

What protocol is used to authenticate identities in AD?

Back 7

Kerberos

Front 8

explain Kerberos

Back 8

User/pc logs to the domain
Kerberos authenticates its credentials and issues a package of info called TGT
Kerberos request is send to a domain controller along with the TGT that ids the user
DC issues to the user/pc another package of info - service ticket that ids the authenticated user on the server

Front 9

Access controll

Back 9

The IDA infrastructure is responsible for protecting info and resources by ensuring that access to resources is granted to only the identities that should have access.

Front 10

What is DACL?

Back 10

Every object within AD has an associated DACL. This list contains info regarding the identities that have been granted access to the object and the level of access granted

Front 11

Auditing

Back 11

Monitoring activities that occur within the IDA infrastructure is referred to as auditing.
Auditing behavior is controlled by system access control lists (SACLs).

Front 12

SACL
ADAM
PKI
CA
SSO

Back 12

SACL - system access control list
ADAM - AD Application Mode
PKI - public key infrastructure
CA - certificate authority
SSO - single sign-on

Front 13

Active Directory itself now includes five technologies, each of which is identified with a keyword that indicates the purpose of the technology

Back 13

Active Directory Domain Services (Identity)
Active Directory Lightweight Directory Services (Applications)
Active Directory Certificate Services (Trust)
Active Directory Rights Management Services (Integrity)
Active Directory Federation Services (Partnership)

Front 14

AD LDS

Back 14

AD LDS - Active Directory Lightweight Directory Services (Applications)
essentially a stand alone version of AD
provides support for directory-aware appz

Front 15

AD CS

Back 15

AD CS - Active Directory Certificate Services (Trust)
used to set up a certificate authority for issuing digital certs as part of PKI

Front 16

AD RMS

Back 16

AD RMS - Active Directory Rights Management Services (Integrity)
an information-protection technology that enables you to implement persistent usage policy templates that define allowed//disallowed use online/offline

Front 17

AD FS

Back 17

AD FS - Active Directory Federation Services (Partnership)

enables an organization to extend IDA across multiple platforms including non-Windows
project identities and access rights across security boundaries to trusted partner

Front 18

schema in AD

Back 18

a set of rules that defines the classes of objects and attributes that can be contained in AD
The fact that AD has user object that includes pass and username is because the schema defines the user object class, the two attributes and the association between

Front 19

Replication services

Back 19

distribute directory data across a network. This includes both the data store itself as well as data required to implement policies and configuration, including logon scripts

Front 20

global catalaog

Back 20

contains information about every object in the AD
its like an index that can be used to locate objects in the AD

Front 21

AD DS

Back 21

AD DS - Active Directory Domain Services
provides a central repository for identity management within an organization
Provides
Authentication,
Authorization,
Auditing services,
Info management
Info sharing
Searching

Front 22

Domain

Back 22

at least 1 domain is required to create an AD
an administrative unit within which certain capabilities and characteristics are shared
defines the boundaries of administrative policies

Front 23

KDC
GPO

Back 23

KDC - kerberos key distribution center
GPO - group policy objects

Front 24

Forest

Back 24

a collection of AD domains
first domain installed in AD is called forest root domain
A forest contains a single definition of network configuration and a single instance of the directory schema

Front 25

Tree

Back 25

DNS namespace of domains in a forest creates trees within the forest.
If a domain is a subdomain of another domain the tow domains are considered a tree (tree.com and free.tree.com vs blue.com and red.com)

Front 26

functional level

Back 26

functionality available in AD domain or forest depends on its functional level which enables advanced domain-wide/forest-wide feature

Front 27

List functional level (6)

Back 27

Win 2000 native
Win 2000 mixed
Win Server 2003
Win Server 2003 interim
Windows Server 2008
Windows Server 2008 R2

Front 28

OU

Back 28

Organization units
provides a container for objects but also a scope with which to manage the objects

Front 29

Connection between GPO and OU?

Back 29

OU can have GPO linked to them that also a scope with which to manage the objects

Front 30

Sites in AD

Back 30

an AD site is an object that represents a portion of the enterprise within which consistent, high-bandwidth network connectivity is expected
Create boundaries of replication and service usage

Front 31

requirements about IP for DC

Back 31

DC require a static IP address and subnet mask value

Front 32

You want to use a new server running Windows Server 2008 R2 as a domain
controller in your Active Directory domain. Which command do you use to launch
configuration of the domain controller?

Back 32

Dcpromo.exe

Front 33

change pc name (win core)

Back 33

netdom renamecomputer %computername% /newname: SERVER02.

Front 34

set the IPv4 address (win core)

Back 34

netsh interface ipv4 set address name="Local Area Connection" source=static address=10.0.0.12 mask=255.255.255.0 gateway=10.0.0.1 1

netsh interface ipv4 set dnsserver name="Local Area Connection" source=static address=10.0.0.11 primary

Front 35

join a domain (win core)

Back 35

netdom join %computername% /domain:contoso.com.

Front 36

display roles installed (win core)

Back 36

oclist | more

Front 37

MMC
RSAT

Back 37

MMC - Microsoft Management Console
RSAT - Remote Server Administration Tools

Front 38

Preconfigured MMC consoles

Custom MMC consoles

Back 38

Preconfigured - installed automatically when you add a role or feature, to support administration of that role or feature. They function in user mode, so you cannot modify them or save them.

Custom - users can create custom consoles to provide exactly the tools and functionality require

Front 39

Active Directory Users And Computers snap-in

Back 39

Manage most common day-to-day resources, including users, groups, computers, printers, and shared folders. This is likely the most heavily used snap-in for an Active Directory administrator

Front 40

Active Directory Sites And Services snap-in

Back 40

Manage replication, network topology, and related services.

Front 41

Active Directory Domains And Trusts snap-in

Back 41

Configure and maintain trust relationships and the domain and forest functional levels

Front 42

Active Directory Schema snap-in

Back 42

Examine and modify the definition of Active Directory attributes and object classes. This schema is the “blueprint” for Active Directory. It is rarely viewed and even more rarely changed. Therefore, the Active Directory Schema snap-in is not installed by default

Front 43

Active Directory Schema snap-in does not appear in the Add/Remove Snap-ins dialog box until after you have registered the snap-in. How you do that?

Back 43

1. Open Command Prompt with the Run As Administrator option.
2. Type regsvr32.exe schmmgmt.dll and press ENTER.

Front 44

By default, new consoles are
saved in what mode

Back 44

author
enables adding and removing snap-ins, viewing all portions of the console tree and saving customizations

Front 45

Types of user modes that can be used when saving a user console

Back 45

User Mode - Full Access
User Mode - Limited Access, multiple window
User Mode - Limited Access, single windows

Front 46

User Mode – Full Access allows

Back 46

You want users of the console to be able to navigate between and use all snap-ins. Users cannot add or remove snap-ins or change the properties of snap-ins or the console.

Front 47

User Mode – Limited Access, multiple window allows

Back 47

You want users to navigate to and use only the snap-ins that you have made visible in the console tree, and you want to preconfigure multiple windows that focus on specific snap-ins. Users cannot open new windows

Front 48

User Mode – Limited Access, single window

Back 48

You want users to navigate to and use only the snap-ins that you have made visible in the console tree within a single window.

Front 49

file extension for consoles

default location where they are saved

Back 49

.msc

%userprofile%\AppData\Roaming\Microsoft\Windows\StartMenu

Front 50

OUs

Back 50

OUs - Organizational units
administrative containers within Active Directory that are used to collect objects that share common requirements for administration, configuration, or visibility.

Front 51

CN
UPN

Back 51

CN - common name
UPN - user principle name

Front 52

UPN def

Back 52

UPN - user principle name
UPN) suffix that will be appended to the user logon name following the @ symbol.

Front 53

Global group

Back 53

Global group is used to identify users based on criteria such as job function, location,and so on

Front 54

Domain Local group

Back 54

Domain Local group is used to collect users and groups who share similar resource access needs, such as all users who need to be able to modify a project report.

Front 55

Universal group

Back 55

Universal group is used to collect users and groups from multiple domains.

Front 56

dsa.msc

Back 56

opens the Active Directory Users And Computers console

Front 57

DN
CN
DC

Back 57

DN - Distinguished name
CN - common name
DC - domain component.

Front 58

DN def

Back 58

are a kind of path to an object in Active Directory. Each object in Active Directory has a completely unique DN. The user James Fine has the DN CN=James Fine,OU=User Accounts,DC=contoso,DC=com.

Front 59

CN def

Back 59

CN means common name.
en you create a user, the Full Name box is used to create the CN of the user object

Front 60

RDN def

Back 60

RDN - relative distinguished name
The portion of the DN prior to the first OU or container

In CN=James Fine,OU=User Accounts,DC=contoso,DC=com
Its CN=James Fine

Front 61

dsquery user

Back 61

look for a user, whereas DSQuery
computer, DSQuery group, and DSQuery ou would query for their respective object types.
-limit switch to specify how many results
you want returned. Use -limit 0 to return all objects

Front 62

if you want to locate the user named Tony Krijnen, you would enter

Back 62

dsquery user -name “Tony Krijnen”.

Front 63

inheritable permissions

Back 63

inheritable permissions are inherited by the child object.

Not every permission is inheritable

Front 64

Explicit permissions

Back 64

Explicit permissions always override permissions that are inherited from parent objects.

Front 65

DSACLs (Dsacls.exe)

Back 65

a command-line tool that reports on directory
service objects.
If you type the command followed by the distinguished name of an object, you see a report of the object’s permissions.

dsacls.exe "ou=User Accounts,dc=contoso,dc=com"

Front 66

How do you remove or reset permissions that have been delegated

Back 66

1)Open the Advanced Security Settings and Permission Entry dialog boxes to remove permissions.
2)You can click Restore Defaults to you can reset permissions
3)DSACLs /s reset permissions to the schema-defined defaults

Front 67

dsacls /s
dsacls /t

Back 67

/s
reset permissions to the schema defined defaults
/t
make the change for the entire "tree"

Front 68

reset permissions on the User Accounts OU and all of its child OUs and objects, you would enter

Back 68

dsacls "ou=User Accounts,dc=contoso,dc=com" /s /t

Front 69

what if you belong to two groups 1 that allows a certain permission and 2nd that denies the same permission

Back 69

The deny permission prevents you from

Front 70

summarizes the attributes that are copied from the template, grouped by the tabs in the Properties dialog box.

Back 70

*General tab* No properties are copied from the General tab.
*Address tab* P.O. box, city, state or province, ZIP or postal code, and country
or region are copied. Note that the street address itself is not copied.
*Account tab* Logon hours, logon workstations, account options, and account
expiration are copied.
*Profile tab* Profile path, logon script, home drive, and home folder path are copied.
*Organization tab* Department, company, and manager are copied.
*Member Of tab* Group membership and primary group are copied.

Front 71

CSVDE
LDIFDE

Back 71

CSVDE - Comma-Separated Values Data Exchange
LDIFDE - LDAP Data Interchange Format Data Exchange

Front 72

Cmd that creates an object in the directory

Cmd that returns specified attributes of an object

Back 72

DSAdd

DSGet

Front 73

Cmd that modifies specified attributes of an object

Cmd that moves an object to a new container or OU

Back 73

DSMod

DSMove

Front 74

Cmd that removes an object, all objects in the subtree beneath a container object, or both

Cmd that performs a query based on parameters provided at the command line
and returns a list of matching objects.

Back 74

DSRm

DSQuery

Front 75

command adds a user account for Mike
Fitzmaurice

command removes the Mike
Fitzmaurice

Back 75

dsadd user "cn=Mike Fitzmaurice,ou=User Accounts,dc=contoso,dc=com"

dsrm "cn=Mike Fitzmaurice,ou=User Accounts,dc=contoso,dc=com"

Front 76

DS commands that read or manipulate attributes of objects include

Back 76

Dsquery.exe
Dsget.exe
Dsmod.exe

Front 77

command retrieves the home folder path for Mike Fitzmaurice

Back 77

dsget user "cn=Mike Fitzmaurice,ou=User Accounts,dc=contoso,dc=com" -hmdir

Front 78

command shows the basic parameters required to create a user account

Back 78

dsadd user "User DN" -samid "pre-Windows 2000 logon name" -pwd {Password | *}
-mustchpwd yes

dsadd user "cn=Amy Strande,ou=User Accounts,dc=contoso,dc=com" -samid Amy.Strande
-fn Amy -ln Strande -display "Strande, Amy" -pwd Pa$$w0rd -desc "Vice President, IT"

Front 79

CSVDE def

Back 79

CSVDE is a command-line tool that imports or exports Active Directory objects from or to a comma-delimited text file

csvde -f filename

Front 80

CSVDE option
-d RootDN

-p SearchScope

Back 80

-d RootDN
Specifies the distinguished name of the container from which the export will begin. The default is the domain itself

-p SearchScope
Specifies the scope of the search relative to the container specified by -d. SearchScope can be either
base (this object only),
onelevel (objects within this container), or subtree (this container and all subcontainers).

The default is subtree.

Front 81

CSVDE option
-r Filter

n -l ListOfAttributes

Back 81

-r Filter
Filters the objects returned within the scope configured by -d and -p. Filter is a Lightweight Directory Access Protocol (LDAP) query syntax

-l ListOfAttributes
Specifies the attributes that will be exported. Use the LDAP name for each attribute, separated by a comma, as in -l DN,objectClass,sAMAccountName,sn,
givenName,userPrincipalName.

Front 82

output of a CSVDE export lists the selected, exported LDAP attribute names on the first line. Each object follows, one per line

Back 82

DN,objectClass,sn,givenName,sAMAccountName,userPrincipalName
"CN=David Jones,OU=User Accounts,DC=contoso,DC=com",user,Jones,David,david.jones,
[e-mail]
"CN=Lisa Andrews,OU=User Accounts,DC=contoso,DC=com",user,Andrews,Lisa,lisa.andrews,
[e-mail]

Front 83

Importing Users with CSVDE

Back 83

The basic syntax of the CSVDE command for import is:
csvde -i -f Filename [-k]

‑i parameter specifies import mode
‑f parameter identifies the file name to import from or export to
‑k parameter is
useful during import operations because it instructs CSVDE to ignore errors,

Front 84

Ldifde.exe

Back 84

to import or export Active Directory objects, including users.
LDIFDE command implements these batch operations by using LDIF files.

Front 85

LDIF

Back 85

LDIF - LDAP Data Interchange Format

Front 86

LDIF file format consists of a block of lines that, together, constitute a single operation.
Each line consists of an attribute name followed by a colon and the value of the attribute.
Multiple operations in a single file are separated by a blank line.

Back 86

dn: CN=Bonnie Kearney,OU=User Accounts,DC=contoso,DC=com
changetype: add
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: Bonnie Kearney
sn: Kearney
title: Operations
description: Operations (London)
givenName: Bonnie
displayName: Kearney, Bonnie
company: Contoso, Ltd.
sAMAccountName: bonnie.kearney
userPrincipalName: [e-mail]
mail: [e-mail]

Front 87

switches for the LDIFDE command
-i
-f filename

Back 87

-i Turn on Import mode. Without this parameter, LDIFDE exports information

-f filename The file from which to import, or to which to export

Front 88

LDIFDE Parameters
-i
-f filename
-s servername
-c FromDN toDN

Back 88

-i
Import mode

-f filename
Import or export file name

-s servername
The domain controller to bind to for the query

-c FromDN ToDN
Convert occurrences of FromDN to ToDN. This is useful when importing objects from another domain, for example.

Front 89

LDIFDE Parameters
-v
-j
-h
-?

Back 89

-v
Turn on verbose mode.

-j
path Log file location.

-h
Enable Simple Authentication And Security Layer (SASL) encryption.

-?
Help.

Front 90

LDIFDE Parameters
-d RootDN
-r Filter
-p SearchScope

Back 90

-d RootDN
The root of the LDAP search. The default is the root of the domain.

-r Filter
LDAP search filter. The default is (objectClass=*), meaning all objects.

-p SearchScope
The scope, or depth, of the search. Can be subtree (the container and all child containers),
base (the immediate child objects of the
container only), or
onelevel (the container and its immediate child containers).

Front 91

LDIFDE Parameters
-l list
-o list
-k

Back 91

l list
Comma-separated list of attributes to include in export for resulting objects. Useful if you want to export a limited number of attributes.

-o list
List of attributes (comma-separated) to omit from export for resulting objects. Useful if you want to export all but a few attributes.

-k
Ignore errors and continue processing if Constraint Violation or Object Already Exists errors appear.

Front 92

Only _________ is capable of modifying existing objects or removing objects.
You can specify a user's password with DSAdd and you can import user;s password with ____________, but no with _______________.
If you create users within a domain with a policy requiring passwords,
the accounts will be disabled until you reset their passwords and enable the accounts

Back 92

Only __LDIFDE___ is capable of modifying existing objects or removing objects. You can specify
a user’s password with DSAdd, and you can import a user’s password with ___LDIFDE___, but not with ___CSVDE____. If you create users within a domain with a policy requiring passwords, the accounts will be disabled until you reset their passwords and enable the accounts.

Front 93

ADWS - Active Directory Web Services

Back 93

Active Directory Web Services

provides XML Web Services–based protocols to interact with Active Directory. The Active Directory module for Windows PowerShell communicates with these services to perform administrative tasks

Front 94

GUID
SID

Back 94

GUID - Globally Unique Identifier
SID - security identifier

Front 95

ADAC

Back 95

ADAC - Active Directory Administrative Center
ADAC is a graphical interface on top of
Windows PS. When you perform a task with ADAC, you are running one or more
Windows PowerShell cmdlets or scripts behind the scenes

available only on Windows Server 2008 R2 and on Windows 7

Front 96

Linked attributes (def)

Back 96

a pair of attributes
back link and
forward link
The system calculates the value of the back link based on the values set on the forward link

Front 97

constructed attribute (Def)

Back 97

an attribute that is the result of a calculation performed by Active Directory
Exmp. tokenGroups - list of SID of all the groups that the user belongs

Front 98

When you have multiselected the user objects what properties are available in the General tab

Back 98

Description
Office
Tel Number
Fax
Web Page
E-mail

Front 99

When you have multiselected the user objects what properties are available in the Account tab

Back 99

UPN Suffix
Logon Hours
Computer Restriction
all Account Options
Account Expires

Front 100

When you have multiselected the user objects what properties are available in the Address tab

Back 100

Street
P.O Box
City
State/Province
Zip/Postal Code
Country/Region

Front 101

When you have multiselected the user objects what properties are available in the Profile tab

Back 101

Profile Path
Logon Script
Home Folder

Front 102

When you have multiselected the user objects what properties are available in the Organization tab

Back 102

Title
Department
Company
Manager

Front 103

DSMod ps cmd

Example: command changes the office attribute of Tony Krijnen

Back 103

DSMod modifies the attributes of one or more existing objects

dsmod user "cn=Tony Krijnen,ou=User Accounts,dc=contoso,dc=com" -office "Amsterdam"

Front 104

cmd to change the office attribute of Linda Mitchell and Scott Mitchell’s accounts to Sydney

Back 104

dsquery user -name "* Mitchell" | dsmod user -office "Sydney"

Front 105

DSQuery User command

Example: search for all users with last name Mitchel

Back 105

searches Active Directory for users

dsquery user -name "* Mitchell"

Front 106

assume you want to assign all users a home folder on SERVER01 what cmd will you use

Back 106

dsquery user "ou=User Accounts,dc=contoso,dc=com" |
dsmod user -hmdir "\\server01\users\$username$\documents" -hmdrv "U:"

Front 107

The username token for the DS commands is

Back 107

The username token for the DS commands is $username$, not %username%.

Front 108

DSGet command

Back 108

DSGet command gets and outputs selected attributes of one or more objects. Its syntax,
like that of DSMod, is:
dsget user UserDN. . . parameters

Front 109

cmd to display the pre–Windows 2000 logon name of Jeff Ford in the User Accounts OU

Back 109

dsget user "cn=Jeff Ford,ou=User Accounts,dc=contoso,dc=com" -samid

Front 110

display the email addresses of all users whose description attribute indicates that they
are in the Sydney office

Back 110

dsquery user -desc "*Sydney*" | dsget user -email

Front 111

A user’s User Logon Name (Pre–Windows 2000) is

Back 111

sAMAccountName attribute. It’s also sometimes called the samid.
It must be unique for the entire domain.

Front 112

What is the User Logon Name

Back 112

the userPrincipalName attribute, abbreviated as UPN. The UPN consists of a logon name and a UPN suffix which is, by default, the DNS name of the domain in which you create the object.

Front 113

GAL

Back 113

GAL - global address list

Front 114

DSMod command to reset a user’s password and, optionally, force the user to change that password at the next logon

Back 114

dsmod user UserDN -pwd NewPassword -mustchpwd yes

Front 115

User Logon Name (Pre–Windows 2000) = ?

Back 115

User Logon Name (Pre–Windows 2000) = sAMAccountName attribute = samid
Unique in the entire Domain

Front 116

User Logon Name is ?

Back 116

userPrincipalName attribute, abbreviated as UPN
UPN must be unique for the entire forest

Front 117

CN must be unique in
DN must be unique in

Back 117

CN must be unique in the OU (CN = common name)
DN must be unique in the forest

Front 118

Connection between CN and DN

Back 118

CN is the first element of the DN

Front 119

DSMod command to reset a user’s password and, optionally, force the user to change that password at the next logon

Back 119

dsmod user UserDN -pwd NewPassword -mustchpwd yes

Front 120

use the DSMod command to disable an account in AD

Back 120

dsmod user UserDN -disabled yes

enable

dsmod user UserDN -disabled no

Front 121

delete objects from Active Directory by using the DSRm command

Back 121

dsrm UserDN

Front 122

tombstone lifetime

Back 122

is 180 days by default
Active Directory maintains a subset of the account’s properties—most notably its SID—for a period of time called the tombstone lifetime

Front 123

move a user with a command-line tool, use DSMove.

Back 123

dsmove UserDN -newparent TargetOUDN

Front 124

After you delete a user account, you can re-create an account with the same name, will the new account belong to the same groups or have the same resource access

Back 124

No
You will need to rebuild those memberships and permissions for the new account

Front 125

Active Directory Migration Tool is used to

Back 125

The Active Directory Migration Tool is used to migrate accounts between domains.

Front 126

What is a security group

Back 126

A scurty principal with a security identifier (SID) and a member attribute that identifies members

Front 127

To effectively manage even a slightly complex enterprise, you need groups that perform
two distinct purposes:

Back 127

Groups that define roles
These groups, referred to as role groups, contain users, computers, and other role groups based on common business characteristics such as location and job type.

Groups that define management rules
These groups, referred to as rule groups,
define how an enterprise resource is managed.

Front 128

role-based management

Back 128

You define roles of users based on business characteristics and you define management rules
You use two types of groups
Groups that define roles
Groups that define management rules

Front 129

Best practice for naming convention of role groups

Back 129

Simple, unique name, such as Sales or Consultants

Front 130

Best practice for naming convention of management groups

Back 130

Management groups. For example, ACL_Sales Folders_Read

Prefix - identifies the management purpose of group, such as ACL for managing access permissions

Resource identifier - this is the unique identifier for what is being managed

Suffix - for resource access groups, this is the type of access the group manages

Delimiter - this should be a consistently used marker separating prefix, identifier and suffix such as _

Front 131

Distribution groups

Back 131

used primarily by email applications
These groups are not security enabled—they do not have SIDs

Front 132

Security groups

Back 132

are security principals with SIDs
These groups can therefore be used in permission entries in ACLs to control security for resource access.
Security groups can also be used as distribution groups by email applications.

Front 133

List the group scopes

Back 133

local
domain
global
universal

Front 134

Groups scopes are identified by the following characteristics

Back 134

Replication
Where is the group defined and to what systems is the group replicated?

Membership
What type of security principal can the group contain as members?

Availability
Where can the group be used?

Front 135

if Domain A trusts Domain B domain b is

Back 135

trusted
its users and global groups can be member of domain local groups in Domain A
Domain B's users and global groups can be assigned permissions to resources in Domain A

Front 136

Local groups (def)

Back 136

defined and available on single computer
created in the security account manager (SAM) DB of a domain member

Front 137

Local groups (characteristics)

Back 137

Replication - defined only in the local SAM DB of a domain member. The group and its membership are not replicated to any other system

Membership:
-any security principals from the domain
-Users, PC and global groups from any domain in the forest or any trusted domain
-Universal groups defined in any domain in the forest

Availability - local group has only pc-wide scope, cannot be member of any other group

Front 138

Domain local group (def)

Back 138

Domain local groups are primarily used to manage permissions to resources

Front 139

Domain local group (char)

Back 139

Replication - defined in the domain naming context. The group object and its membership are replicated to every domain controller in the domain

Membership:
-Any security principal from the domain
-Users, PC and global groups from and domain in the forest or any trusted domain
-Universal groups defined in the forest

Availability - can be added to ACLs on any resource on any domain member. Can be member of other domain local groups or even computer local groups

Front 140

Global groups (def)

Back 140

Global groups are used primarily to define collections of domain objects based on business roles

Front 141

Global groups (char)

Back 141

Replication - defined in the domain naming context. The group object including the membership (member attribute) is replicated to all domain controllers in the domain

Membership - can include users, computers and other global groups in the SAME DOMAIN ONLY

Availability - available for use by all domain members as well as by other domain in the forest and all trusting external domains
Can be a member of any domain local group or universal group.
Can be member of any domain local group in trusting domain.
Can be added to ACLs in the domain, forest or trusting domain

Front 142

Universal groups (char)

Back 142

Replication
A universal group is defined in a single domain in the forest but is replicated to the global catalog. Objects in the global catalog are readily accessible across the forest

Membership
A universal group can include as members users, global groups, and other universal groups from any domain in the forest

Availability
A universal group can be a member of a universal group or domain local group anywhere in the forest
Additionally, a universal group can be used to manage resources—for example, to assign permissions—anywhere in the forest.

Front 143

Local group scope members from the same domain

Back 143

Local group scope members from the same domain
User,
Computers,
Global Groups,
Universal Groups,
Domain Local Groups,
Local Users Defined on the Same computer as the local group

Front 144

Local group scope members from another domain in the same forest

Back 144

Local group scope members from another domain in the same forest
Users
Computers
Global groups
Universal groups

Front 145

Local group scope members from a trusted external domain

Back 145

Users
Computers
Global groups

Front 146

Domain local group scope members from the same domain

Back 146

Users
Computers
Global groups
Universal groups
Domain local groups

Front 147

Domain local group scope members from another domain in the same forest

Back 147

Users
Computers
Global groups
Universal groups

Front 148

Domain local group scope members from a trusted external domain

Back 148

Users
Computers
Global groups

Front 149

Universal group scope members from the same domain

Back 149

Users
Computers
Global groups
Universal groups

Front 150

Universal group scope members from another domain in the same forest

Back 150

Users
Computers
Global groups
Universal groups

Front 151

Universal group scope members from a trusted external domain

Back 151

N/A

Front 152

Global group scope members from the same domain

Back 152

Users
Computers
Global groups

Front 153

Global group scope members from another domain in the same forest

Global group scope members from a trusted external domain

Back 153

N/A

N/A