Group Policy settings are contained in a and determine the user’s desktop environment. You can view the Group Policy settings for a GPO in the Group Policy Object Editor. There are two types of Group Policy settings: computer configuration settings and user configuration settings. They are contained in the Computer Configuration and the User Configuration nodes in a GPO.
You set permissions to either Allow or Deny. Deny permissions take precedence over all other permissions. For example, if you deny permission to a user to gain access to an object, the user will not have that permission, even if you allow the permission for a group of which the user is a member. The object type determines which permissions you can select. For example, you can assign the Reset Password permission to a security principal for a user object but not for a printer object. For each object type, there is a group of standard permissions and a group of more detailed special permissions.
Standard permissions are the most frequently assigned. You can view the standard permissions in the Security tab in the Properties dialog box for an object, shown in Figure 9-6.
To view the standard permissions for an object, complete the following steps:
1. Click Start, point to Administrative Tools, and then click Active Directory Users And Computers. On the View menu, ensure that Advanced Features is selected. Right-click the object for which you want to view standard permissions and click Properties.
In the Properties dialog box for the object, click the . Click the appropriate security principal in the Group Or User Names box to view the assigned standard permissions.
Important You must select Advanced Features on the View menu to be able to access the Security tab.
Table 9-3 lists the basic standard permissions that are available for most objects (some object types have additional standard permissions) and the type of access that each permission allows.
Standard permissions are composed of special permissions, which provide you with a finer degree of control for assigning access to objects. For example, the standard Write permission is composed of the Write All Properties and All Validated Writes special permissions. Special permissions are also referred to as advanced security settings. You can view the special permissions in the Permission Entry dialog box for an object, shown in Figure 9-7.
The saved queries feature enables administrators to create, edit, save, organize and e-mail saved queries in order to monitor or perform a specific task on direc?tory objects. Saved queries are stored in the Saved Queries container in the Active Directory Users And Computers console. Saved queries can be exported to an .xml file and imported into other Active Directory Users And Computers consoles located on Windows Server 2003 domain controllers in the same domain.
Recent Articles