Lecture 8 permissions
Download as PPTX, PDF1 like1,131 views
This document discusses permissions and groups in Active Directory. It covers the different types of groups (distribution, security, etc.), and how a group's scope (domain local, global, universal) determines what objects it can include and what resources it can be assigned permissions for. The document also discusses domain and forest functional levels, inheritance and precedence of permissions, and how to use different types of groups effectively to structure access to resources.
![Domain Functional Levels[1]
• Limits what functionality domain controllers offer within the domain.
• All functional levels provide the default Active Directory Domain
Services feature set plus additional features depending on the operating
system.
Functional Level Features[1]
Windows 2000 Native Universal groups enabled for distribution and
Network Design & Administration
security groups; group nesting; group
conversion; SID history.
Windows Server 2003 Domain rename; last logon timestamp;
password setting on inetOrgPerson / User
objects; redirect users/computers containers;
authorisation manager policies; constrained
delegation; selective authorisation.
Windows Server 2008 Distributed File System replication of SYSVOL;
Advanced Encryption Services for Kerberos;
interactive logon info; fine-grained password 4
policies
Windows Server 2008 R2 Active Directory domain recycle bin.](https://image.slidesharecdn.com/lecture8-permissions-130204184329-phpapp01/85/Lecture-8-permissions-4-320.jpg)
![Forest Functional Levels[1]
• Functional levels impact the forest functional level.
• Each Server version adds more features to basic forest
functionality.
Forest Functional Level Features[1]
Network Design & Administration
Windows 2000 Default AD feature set
Windows Server 2003 Forest trust; domain rename; linked value
replication; Read-only domain controllers
(RODC); improved knowledge consistency
checker; dynamic objects;
deactivation/redefinition of attributes and
classes in schema.
Windows Server 2008 No additional forest level features; will default
to a Server 2008 FL instead of a 2003 FL. 5
Windows Server 2008 R2](https://image.slidesharecdn.com/lecture8-permissions-130204184329-phpapp01/85/Lecture-8-permissions-5-320.jpg)
![Group Scope Revisited![2]
• Scope can be domain local, global, or universal.
Group Scope Group Membership Can Include[2] Can be used to [2]
Domain Local User accounts from any domain in the Assign access to resources
forest; global groups or universal groups only in the local domain; on
from any domain in the forest; user all servers in domain
Network Design & Administration
accounts or global or universal groups running Windows Server
from any domain in trusted forest; 2000/2003/2008.
nested domain local groups from the
local domain.
Global User accounts from the domain where Assign access to resources in
the group is created; nested global all domains in forest or
groups from the local domain. between trusted forests;
member servers running
Windows Server.
Universal User accounts from any domain in Assign access to resources in 6
forest; global groups from any domain all domains in forest or
in forest; nested universal groups from between trusted forests; on
any domain in forest. all servers running 2000 +](https://image.slidesharecdn.com/lecture8-permissions-130204184329-phpapp01/85/Lecture-8-permissions-6-320.jpg)
![Access Control Lists (ACL)
• An Access Control List is associated to an object being accessed, not
the object accessing it.
• Lists all permissions that can access that object. (e.g. users, groups,
etc.)
• Also lists what operations can be done to the object.
Network Design & Administration
• List made out of Access Control Entries (ACE’s) (i.e. the name of the
security principle and the permissions it has been granted)
• Example:
/home/cmp3robinj/
[ACL] Access Control Entry
(cmp3robinj, read)
(cmp3robinj, write)
(cmp3robinj, create)
(cmp3robinj, delete)
13
(admins, read)
(admins, write)](https://image.slidesharecdn.com/lecture8-permissions-130204184329-phpapp01/85/Lecture-8-permissions-13-320.jpg)
![Next time & References
• Further different sorts of permissions – including file shares.
[1] Windows Server 2008 Active Directory Resource Kit, page 181-
Network Design & Administration
[2] Windows Server 2008 Active Directory Resource Kit, page 368-
369
22](https://image.slidesharecdn.com/lecture8-permissions-130204184329-phpapp01/85/Lecture-8-permissions-22-320.jpg)
Lecture 8 permissions
- 1. Lecture 8: Permissions and Resources Network Design & Administration
- 2. Group Types • When defining a group, need to consider its type. • This will dictate what it can and cannot do (i.e. security and permissions of group). • Four basic types of groups: • Distribution groups Network Design & Administration • Security groups • Application basic groups • LDAP query groups • Administrators mostly use security groups to specify what permissions the group has when interacting with a resource. • Distribution groups are used when limited access to a resource is required (e.g. used extensively in MS Exchange Server for sending emails to groups) 2
- 3. Groups Scope • Groups have a Scope. • Depending on its scope, a group can be assigned permissions to different extents in the domain structure. • There are three types of scope: • Domain Local Network Design & Administration • Global • Universal • Group scope is affected by the Functional Level of the domain in which it exists. • The functional level of a domain is dictated by the lowest version of windows server running as a domain controller within the domain. • This can also dictate the functional level of a forest. 3
- 4. Domain Functional Levels[1] • Limits what functionality domain controllers offer within the domain. • All functional levels provide the default Active Directory Domain Services feature set plus additional features depending on the operating system. Functional Level Features[1] Windows 2000 Native Universal groups enabled for distribution and Network Design & Administration security groups; group nesting; group conversion; SID history. Windows Server 2003 Domain rename; last logon timestamp; password setting on inetOrgPerson / User objects; redirect users/computers containers; authorisation manager policies; constrained delegation; selective authorisation. Windows Server 2008 Distributed File System replication of SYSVOL; Advanced Encryption Services for Kerberos; interactive logon info; fine-grained password 4 policies Windows Server 2008 R2 Active Directory domain recycle bin.
- 5. Forest Functional Levels[1] • Functional levels impact the forest functional level. • Each Server version adds more features to basic forest functionality. Forest Functional Level Features[1] Network Design & Administration Windows 2000 Default AD feature set Windows Server 2003 Forest trust; domain rename; linked value replication; Read-only domain controllers (RODC); improved knowledge consistency checker; dynamic objects; deactivation/redefinition of attributes and classes in schema. Windows Server 2008 No additional forest level features; will default to a Server 2008 FL instead of a 2003 FL. 5 Windows Server 2008 R2
- 6. Group Scope Revisited![2] • Scope can be domain local, global, or universal. Group Scope Group Membership Can Include[2] Can be used to [2] Domain Local User accounts from any domain in the Assign access to resources forest; global groups or universal groups only in the local domain; on from any domain in the forest; user all servers in domain Network Design & Administration accounts or global or universal groups running Windows Server from any domain in trusted forest; 2000/2003/2008. nested domain local groups from the local domain. Global User accounts from the domain where Assign access to resources in the group is created; nested global all domains in forest or groups from the local domain. between trusted forests; member servers running Windows Server. Universal User accounts from any domain in Assign access to resources in 6 forest; global groups from any domain all domains in forest or in forest; nested universal groups from between trusted forests; on any domain in forest. all servers running 2000 +
- 7. Why? • Allows different groups different degrees of permission when included within each other. • Different sorts of objects are allowed membership of different group types (scopes) Network Design & Administration • Remember, this applies to security groups. Distribution groups, as mentioned previously, only relate to directory-aware applications (e.g. MS Exchange) • Since security groups can also be used as distribution groups, often don’t bother with the 7 latter.
- 8. Domain Local Groups • Available even in lower domain functional levels. • Typically assigned permissions to resources. (e.g. shared folder or printer) • Then allows easier group nesting Network Design & Administration • Can also be used to group users from the same domain needing the same permissions to access a resource in the same domain. • Can only be used to assign permissions to resources in the domain in which they were created (the meaning of domain local!) • See table for permitted membership. 8
- 9. Global groups • Often used to gather users or computers together in the same domain with same role or function, or requiring similar access requirements. • Can only include members from within their own domain Network Design & Administration (including other global groups from the same domain). • Can be granted permissions for resources in any domain in the forest and in trusted domains in other forests. • Not replicated outside of their own domain – using them minimises replication traffic to the global catalogue. • Use these for objects that require frequent maintenance. (e.g. user or computer accounts) 9
- 10. Universal groups • Used mainly to grant access to related resources in multiple domains. • e.g. if executives need access to printers throughout the network. • Mainly used to consolidate groups than span multiple Network Design & Administration domains – unnecessary in single-domain networks. • Best practice: • Create global group in each domain for user or computer accounts, then universal group contains the global groups. • Avoids too much replication traffic, since universal group membership changes infrequently. 10
- 11. Global & Domain Local Groups - Planning 1. Create domain local groups for shared resources (e.g. A group for a set of colour printers) 2. Assign resource permissions to domain local group (e.g. Whatever permissions needed to use Network Design & Administration printers) 3. Create Global groups for users with common roles (e.g. Accounts or Sales) 4. Add global groups into appropriate domain local groups (e.g. To give Sales access to the specialist 11 printers)
- 12. Permissions • A privilege granted to a user, group or computer to perform a particular action or access a particular resource. • Windows Server 2008 has many different sorts Network Design & Administration of permissions – most visible are: • File-system – access to files & folders under NTFS. • Share – access to file system and printer shares. • AD – access to Active Directory objects. • Registry – access to registry keys. 12 • They are all separate/different!
- 13. Access Control Lists (ACL) • An Access Control List is associated to an object being accessed, not the object accessing it. • Lists all permissions that can access that object. (e.g. users, groups, etc.) • Also lists what operations can be done to the object. Network Design & Administration • List made out of Access Control Entries (ACE’s) (i.e. the name of the security principle and the permissions it has been granted) • Example: /home/cmp3robinj/ [ACL] Access Control Entry (cmp3robinj, read) (cmp3robinj, write) (cmp3robinj, create) (cmp3robinj, delete) 13 (admins, read) (admins, write)
- 14. NTFS Permissions • Mostly can use Standard permissions for NTFS files and folders: • Read, Read & Execute, Write, Modify, List Folder Contents, Full Control Network Design & Administration • Occasionally need to set up more fine-grained, using the 14 NTFS Special Permissions. • The Standard permissions are just a convenient grouping into most frequently used sets. • There are slight differences when permissions are applied to a file rather than a folder (and List Folder 14 Contents is obviously not applicable to files!)
- 15. Example Permissions Creator Owner is a ‘Special Network Design & Administration User’. Will discuss again later. Permissions can be explicitly Allowed or Denied. Note: list in this case gives Users Read & Execute, List 15 folder contents and read permissions only.
- 16. Access to Special Permissions Note that permissions can be inherited from higher folders (not applicable when it’s c: ) Network Design & Administration To make more detailed changes, need to edit an individual ACE. 16
- 17. Example Permissions Breakdown “Read & Execute” is composed of: List Folder/Read Data Read Attributes Network Design & Administration Read Extended Attributes Read Permissions Synchronise Traverse Folder/Execute File Lets security principals move through Without this, get “Read” Standard Permissions. 17 inaccessible folders to reach folders / files they are allowed to access.
- 18. Inheritance Rules for Permissions • By default, subordinate objects inherit permissions possessed by parent. • e.g. if user is granted permission to root of Network Design & Administration a drive, they have same permission on all files and subfolders. • Can counteract inheritance by either: • Turning off inheritance – when working with special permissions. • Deny permissions explicitly. 18
- 19. Precedence Rules for Permissions • Allowed permissions are cumulative: • All of the permissions of a security principal combine to give the Effective Permissions. • Denied permissions override Allowed Network Design & Administration permissions: • Explicitly denying permissions overrides Allowed from any other source. • Explicit permissions take precedence over inherited permissions 19 • So explicitly Allowed override inherited Denied.
- 20. Permissions can get complicated! • As a result, depending on a user’s group membership and any permissions given explicitly to that user, get combination of all of them! • Not directly shown in Properties window since it shows Network Design & Administration separate groups etc. • e.g. User cmp3robinj is granted Allow Read & Execute on folder ModuleSpecs. But cmp3robinj is also member of the Lecturers group, which has been granted Allow Full Control and the Everyone group, granted Allow Read. • Therefore, cmp3robinj has effective permission of 20 Allow Full Control on this folder. • Need to use Effective Permissions view.
- 21. Effective Permissions Checking on a single folder or file to determine a particular user’s permissions. Network Design & Administration Only takes account of NTFS interactions. Does not include effects of Share Permissions or login method. 21 Read-only!
- 22. Next time & References • Further different sorts of permissions – including file shares. [1] Windows Server 2008 Active Directory Resource Kit, page 181- Network Design & Administration [2] Windows Server 2008 Active Directory Resource Kit, page 368- 369 22