Add in groups to other groups in the process called nasty and nasty and creates a hierarchy of groups
that supports your business rules and management rules.
A best practice for group nest and is known as IGAD L. A which is an acronym for the following Identities
Global groups domain local groups and access the parts of IGAD L.A. are related to the following away
identities which are user and computer accounts are members of global groups which represent business
roles global groups also known as Role groups are members of domain local groups which represent management
rules for example determining who has the Reaper mission to a specific collection of folders.
Then domain local groups also known as rebel groups they are granted access to resources in the case
of a shared folder you grant access by ad and the domain local group to their folders a sale without
permission that provides the appropriate level of access.
Now in a mall to demand forest the best practice for group nesting is known as AI G U D L.A. the additional
letter U stands for universal groups and in this case we have identities.
Global groups universal groups demand local groups and access.
In this case global groups from multiple domains are members of a single universal group that universal
group is a member of domain local groups in multiple domains.
Now let's review IGAD L.A. example.
The figure on this slide represents a group of implementation that reflects the technical view of group
management best practices or IGAD L.A. and the business view of a role based rule based management.
Consider the following scenario the sales force that controls so company has just completed its fiscal
year sales files from the previous year are in a folder called sales.
The sales force needs read access to the sales folder additionally a team of auditors from would groove
band which is a potential investor requiring read access to the sales folder to perform the audit.
You can implement the security for this scenario by following these steps.
The first step is to sign users with common job responsibilities or other business characteristics to
Role groups which are implemented as global security groups.
Do this separately in each domain.
Ad sales people at Cantor also do a sales role group at auditors that would groove bank turn auditors
roll group.
The second step is to create a group to manage access to the sales folders with Reid permission.
You implement this in the demand that contains the resource that is being managed.
In this case the sales folder in the control so domain.
Therefore you create the resource access management rule group as a domain local group named ACL sales.
Read the third step is to add to the role groups to the resource access management rule group to represent
the management rule.
These groups can come from any domain in the forest or from a trusted domain such as wood group band
global groups from trusted external domains or from any domain and then in the same forest can be member
so a domain local group and the third step is to assign the permissions that implements the required
level of access.
In this case grant the allow read permission to the domain local group.
This strategy results in two single points of management thereby reducing the management burden.
One part of management defines who is in sales and the other point of management defines who is an auditor.
Because these roles are likely to have access to a variety of resources beyond the sales folder.
You have another single point of management to determine who has read access to the sales folder.
Furthermore the sales folder might not be a single folder on a single server.
It could be a collection of folders across multiple servers each of which assigns the allow read permission
to the single demand local group.
Some words about configure and a group manager the properties page of a group has a managed by tab.
Use this to provide information about which manager is responsible for this group.
When you add a user or group to the name field ADT s will provide information about that user such as
office address and telephone number.
There is also a checkbox called manager who can update membership list that allows the manager over
the group to manage group membership.
This is useful in distributed administrative environments in which manager are responsible for controlling
their own department groups.