Group Membership

[Guest]

Archived from groups: microsoft.public.win2000.active_directory (More info?)

I have users who are both members of the Domain users and All Users Group?
IS this neccessary to be members of both? Is there a security risk having
users part of the All Users group.

Thanks,
George

 

[Guest]

Archived from groups: microsoft.public.win2000.active_directory (More info?)

I am pretty sure that Domain Users contains All Users except the Guests. I
wouldn't think there would be a problem with Domain Users being a part of
All Users. If it were the other way around I could see there being a
problem.

-Steven-
"George Schneider" <georgedschneider@news.postalias> wrote in message
news:F1B71DC3-143E-4256-A49C-406B9EDBDAF9@microsoft.com...
>I have users who are both members of the Domain users and All Users Group?
> IS this neccessary to be members of both? Is there a security risk having
> users part of the All Users group.
>
> Thanks,
> George

 

[Guest]

Archived from groups: microsoft.public.win2000.active_directory (More info?)

Hi George,

Thanks for posting£¡

Based on my research, by default, Domain Admins is a member of the
Administrators group of all workstations and member servers. Similarly,
Domain Users is a member of the Users group of those computers. Hence, you
only need to have users in Domain Users group.

More information for your reference:
Everyone Group Does Not Include Anonymous Security Identifier
http://support.microsoft.com/default.aspx?scid=kb;en-us;278259

Planning Distributed Security
http://www.microsoft.com/resources/documentation/Windows/2000/server/reskit/
en-us/Default.asp?url=/resources/documentation/Windows/2000/server/reskit/en
-us/deploy/dgbe_sec_rzdw.asp

Well-known security identifiers in Windows operating systems
http://support.microsoft.com/default.aspx?scid=kb;en-us;243330

If there is anything that is unclear, please feel free to let me know.

Thanks & Regards,

Jason Tan

Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security

=====================================================

When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.

=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------
| Thread-Topic: Group Membership
| thread-index: AcVQxfkqmTUWdNcrSSGgydzfPVK1VQ==
| X-WBNR-Posting-Host: 209.244.152.162
| From: "=?Utf-8?B?R2VvcmdlIFNjaG5laWRlcg==?="
<georgedschneider@news.postalias>
| Subject: Group Membership
| Date: Wed, 4 May 2005 09:26:06 -0700
| Lines: 6
| Message-ID: <F1B71DC3-143E-4256-A49C-406B9EDBDAF9@microsoft.com>
| MIME-Version: 1.0
| Content-Type: text/plain;
| charset="Utf-8"
| Content-Transfer-Encoding: 7bit
| X-Newsreader: Microsoft CDO for Windows 2000
| Content-Class: urn:content-classes:message
| Importance: normal
| Priority: normal
| X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0
| Newsgroups: microsoft.public.win2000.active_directory
| NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250
| Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGXA03.phx.gbl
| Xref: TK2MSFTNGXA01.phx.gbl
microsoft.public.win2000.active_directory:29058
| X-Tomcat-NG: microsoft.public.win2000.active_directory
|
| I have users who are both members of the Domain users and All Users
Group?
| IS this neccessary to be members of both? Is there a security risk
having
| users part of the All Users group.
|
| Thanks,
| George
|