Controllingaccess To Active Directory Objects

By Author: Mike Jones
Total Articles: 256
Comment this article

Windows Server 2003 uses an object-based security model to implement access control Network+ exam for all Active Directory objects. This security model is similar to the one used to implement NTFS file system security. Every Active Directory object has a security descriptor that defines who has permission to gain access to the object and what type of access is allowed. Windows Server 2003 uses these security descriptors to control access to objects. This lesson explains how to set permissions for Active Directory objects.
Understanding Access Control
To control access to Active Directory objects, you grant or deny permissions to security principals. A permission is the authority to perform an operation or a set of operations on an object and is granted or denied by the object's owner. A security principal is a user, group, computer, or service that is assigned a unique security identifier (SID). A SID uniquely identifies the user, group, computer, or service in the enterprise and is used to manage security principals. As an administrator, it is your responsibility ...
... to manage permissions for security principals. Recall from the discussion in Chapter 8 that OUs are not security principals; therefore, you cannot assign access permissions to OUs. You can set access permissions only on drives formatted to use NTFS.
Off the Whoami is a command line utility that displays social networking benefits information about the currently logged on user. You can use this utility to learn about a specific user account before you begin to troubleshoot a resource access problem. The Whoami /all command can be used to the view the SID, group memberships, and specific permissions of a user account. Whoami is included in Windows Server 2003. Although the utility is not available in the default installations of Windows 2000 or Microsoft Windows XF? you can install it from the Resource Kit CD for each of those products.
Windows Server 2003 stores a list of user access permissions, called the access control list (ACL), for every Active Directory object. The ACL for an object lists who can access the object and the specific actions that each user can perform on the object. Windows Server 2003 offers a fine degree of control over access to a -wide variety of objects. To provide a security principal with access to an object, you add the security principal to the ACL of the object. Then you can adjust the specific permissions that the security principal has for the object.

The Find option on the Active Directory Users And Computers console enables you to search for users, contacts, groups, computers, printers, shared folders, OUs, remote installation servers, and remote free practice IT questions installation clients according to criteria you specify.