Group creation questions for Active Directory

1.What’s the difference between local, global and universal
groups?
Domain local groups assign access permissions to global
domain groups for local domain resources. Global groups
provide access to resources in other trusted domains.
Universal groups grant access to resources in all trusted
domains.

2.I am trying to create a new universal user group. Why
can’t I?
Universal groups are allowed only in native-mode Windows
Server 2003 environments. Native mode requires that all
domain controllers be promoted to Windows Server 2003
Active Directory.

3.What is LSDOU? It’s group policy inheritance model, where
the policies are applied to Local machines, Sites, Domains
and Organizational Units.
Why doesn’t LSDOU work under Windows NT? If the
NTConfig.pol file exist, it has the highest priority among
the numerous policies.
4.Where are group policies stored?
%SystemRoot%System32\GroupPolicy

5.What is GPT and GPC?
Group policy template and group policy container.

6.Where is GPT stored?
%SystemRoot%\SYSVOL\sysvol\domainname\Policies\GUID

7.You change the group policies, and now the computer and
user settings are in conflict. Which one has the highest
priority?
The computer settings take priority.

8.You want to set up remote installation procedure, but do
not want the user to gain access over it. What do you do?
gponame–> User Configuration–> Windows Settings–> Remote
Installation Services–> Choice Options is your friend.

9.What’s contained in administrative template conf.adm?
Microsoft NetMeeting policies

10.How can you restrict running certain applications on a
machine?
Via group policy, security settings for the group, then
Software Restriction Policies.

11.You need to automatically install an app, but MSI file
is not available. What do you do?
A .zap text file can be used to add applications using the
Software Installer, rather than the Windows Installer.

12.What’s the difference between Software Installer and
Windows Installer?
The former has fewer privileges and will probably require
user intervention. Plus, it uses .zap files.

13.What can be restricted on Windows Server 2003 that
wasn’t there in previous products?
Group Policy in Windows Server 2003 determines a users
right to modify network and dial-up TCP/IP properties.
Users may be selectively restricted from modifying their IP
address and other network configuration parameters.

14.How frequently is the client policy refreshed?
90 minutes give or take.

15.Where is secedit?
It’s now gpupdate.

16.You want to create a new group policy but do not wish to
inherit.
Make sure you check Block inheritance among the options
when creating the policy.

17.What is "tattooing" the Registry?
The user can view and modify user preferences that are not
stored in maintained portions of the Registry. If the group
policy is removed or changed, the user preference will
persist in the Registry.

18.How do you fight tattooing in NT/2000 installations?
You can’t.

19.How do you fight tattooing in 2003 installations?
User Configuration - Administrative Templates - System -
Group Policy - enable - Enforce Show Policies Only.

20.What does IntelliMirror do?
It helps to reconcile desktop settings, applications, and
stored files for users, particularly those who move between
workstations or those who must periodically work offline.

21.What’s the major difference between FAT and NTFS on a
local machine?
FAT and FAT32 provide no security over locally logged-on
users. Only native NTFS provides extensive permission
control on both remote and local files.

23.How do FAT and NTFS differ in approach to user shares?
They don’t, both have support for sharing.
24.Explan the List Folder Contents permission on the folder
in NTFS.
Same as Read & Execute, but not inherited by files within
a folder. However, newly created subfolders will inherit
this permission.

25.I have a file to which the user has access, but he has
no folder permission to read it. Can he access it?
It is possible for a user to navigate to a file for which
he does not have folder permission. This involves simply
knowing the path of the file object. Even if the user can’t
drill down the file/folder tree using My Computer, he can
still gain access to the file using the Universal Naming
Convention (UNC). The best way to start would be to type
the full path of a file into Run… window.
26.For a user in several groups, are Allow permissions
restrictive or permissive?
Permissive, if at least one group has Allow permission for
the file/folder, user will have the same permission.

27.For a user in several groups, are Deny permissions
restrictive or permissive?
Restrictive, if at least one group has Deny permission for
the file/folder, user will be denied access, regardless of
other group permissions.

28.What hidden shares exist on Windows Server 2003
installation?
Admin$, Drive$, IPC$, NETLOGON, print$ and SYSVOL.

29.What’s the difference between standalone and fault-
tolerant DFS (Distributed File System) installations?
The standalone server stores the Dfs directory tree
structure or topology locally. Thus, if a shared folder is
inaccessible or if the Dfs root server is down, users are
left with no link to the shared resources. A fault-tolerant
root node stores the Dfs topology in the Active Directory,
which is replicated to other domain controllers. Thus,
redundant root nodes may include multiple connections to
the same data residing in different shared folders.

30.We’re using the DFS fault-tolerant installation, but
cannot access it from a Win98 box.
Use the UNC path, not client, only 2000 and 2003 clients
can access Server 2003 fault-tolerant shares.

31.Where exactly do fault-tolerant DFS shares store
information in Active Directory?
In Partition Knowledge Table, which is then replicated to
other domain controllers.

32.Can you use Start->Search with DFS shares?
Yes.

33.What problems can you have with DFS installed?
Two users opening the redundant copies of the file at the
same time, with no file-locking involved in DFS, changing
the contents and then saving. Only one file will be
propagated through DFS.

34.I run Microsoft Cluster Server and cannot install fault-
tolerant DFS.
Yeah, you can’t. Install a standalone one.

35.Is Kerberos encryption symmetric or asymmetric?
Symmetric.

36.How does Windows 2003 Server try to prevent a middle-man
attack on encrypted line?
Time stamp is attached to the initial client request,
encrypted with the shared key.

37.What hashing algorithms are used in Windows 2003 Server?
RSA Data Security’s Message Digest 5 (MD5), produces a 128-
bit hash, and the Secure Hash Algorithm 1 (SHA-1), produces
a 160-bit hash.

38.What third-party certificate exchange protocols are used
by Windows 2003 Server?
Windows Server 2003 uses the industry standard PKCS-10
certificate request and PKCS-7 certificate response to
exchange CA certificates with third-party certificate
authorities.

39.What’s the number of permitted unsuccessful logons on
Administrator account?
Unlimited. Remember, though, that it’s the Administrator
account, not any account that’s part of the Administrators
group.

40.If hashing is one-way function and Windows Server uses
hashing for storing passwords, how is it possible to attack
the password lists, specifically the ones using NTLMv1?
A cracker would launch a dictionary attack by hashing every
imaginable term used for password and then compare the
hashes.

41.What’s the difference between guest accounts in Server
2003 and other editions?
More restrictive in Windows Server 2003.

42.How many passwords by default are remembered when you
check "Enforce Password History Remembered"?
User’s last 6 passwords.

1. How would you troubleshoot AD Replication (
Intersite & Intrasite ) and what are the tools which you
would use -  Event Viewer / RPC / Repadmin / DcDiag /
Replmon / Subnet Information – Event ID 1311 / 1290 / 1586.

Senario -  There are 4 Sites – Site A – Site B – Site C –
Site D. Site A connected to Site B, Site B connected to
Site C, Site C connected to Site D, but Site D is not
connected to Site A. So how long would replication take
from Site A to Site D.

Answer – Site to Site replication takes 15 min in Windows
2003 Domain, so it would take 45 min for an object to be
replicated from Site A to Site D.

2. What are the various Attributes for an Object –
Answer – Address, E-Mail,

3. Which are the different Naming Context in AD –
Answer – Domain / Configuration / Schema / Application /
Domain DNS / Forest DNS

4. How would you Force Replication in AD & FRS –
Answer – AD Replication can be forced using Replmon, FRS
Replication can be forced by a relevant D2 or D4.

5. Senario Based – A User in Site A changes his
Password and then tries  to Login in Site B, so would he be
able to login with his new Password or would require to
Login with Cached Credentials.
Answer – Yes, the User would be able to Login to Site B
with the new password as password replications are Urgent
Replications and are triggered in 15 Sec.

6. What is FRS ? Why is it Used and what are the tools
to monitor FRS ?
Answer – FRS is used to replicate GPO’s and Scripts b/w
DC’s and also used to Replicate DFS Data. Tools to monitor
FRS are – FRSDiag / Ultrasound / Sonar / Event Viewer.

7. What are Morphed Folders and what are they created
and what is the way to Troubleshoot them.
Answer – Morphed folders are duplicate folders with same
name created due to Replication Link Failure or Forced
Traffic in DFS & FRS.

8. What is Sharing Voilation ?
Answer – Sharing Voilation is multiple user accessing the
same file while that file is Replicating through FRS or DFS
and fails replication cause User are using the File and it
is in use. Sharing Voilation can be troubleshot by doing a
D2 on the Server.

9. What is Backlog Issue in FRS ?
Answer – Backlog issue is when Server A is replicating
files to Server B and Server B is not accepting those files
then the files are accumulating and creating a Backlog on
Server B. Troubleshooting step is D2 on Server B.

10. How would you flush and register a DNS Record –
Answer – Ipconfig /flushdns & ipconfig /registerdns.

11. What are the Various Records for a DC in DNS ?
Answer – Host A / GUID / Kerberos / GC Record / _MSDCS
Record.

12. What is the difference b/w Primary Zone / AD
Integrated Zone  and Secondary Zone in terms of Usage and
Replication.
Answer – Primary Zone is a editable copy but replicated
through DNS Replication. AD integrated zone is AD
integrated and is replicated through AD. Secondary zone is
a readonly copy of either Primary or AD Integrated Zone.

13. How would you troubleshoot disappeared DNS Records
and what is the use of C Name Record ?

14. What is Scavenging and what are Stale Records in
DNS ?

Answer – Scavenging is automatic removal of Stale Records
in DNS, default period is 7 days.

15. What are the tools to monitor GPO Replication –
Answer – GPResult / Userenv / RSOP / GpoTool.


16. There are 1000 Users in an OU and you would like to
apply a Policy to only 200 Users in that OU. How is that
possible ?
Answer – GPO Filtering. User and Computer part of a Policy
can also be filtered if required.

There is only 1 Password Policy per Domain no matter what.

17. How would you recover a deleted User / GPO or OU
Answer – Study the KB 840001 and NTDSUtil Tool.

18. What are FSMO Roles –
Answer – Study all the roles properly cause he might ask
you to describe any one.

Understanding User and Group Accounts

Managing accounts is one of your primary tasks as a Microsoft Windows 2000 administrator. Chapter 3 discussed computer accounts. This chapter examines user and group accounts. User accounts enable individual users to log on to the network and access network resources. Group accounts are used to manage resources for multiple users. The permissions and privileges you assign to user and group accounts determine which actions users can perform, as well as which computer systems and resources they can access.
Although you may be tempted to give users wide access, you need to balance the user's need for job-related resources against your need to protect sensitive resources or privileged information. For example, you wouldn't want everyone in the company to have access to payroll data. Consequently, you'd make sure that only those who need that information have access to it.

The Windows 2000 Security Model

You control access to network resources with the components of the Windows 2000 security model. The key components you need to know about are the ones used for authentication and access controls.

Authentication Protocols

Windows 2000 authentication is implemented as a two-part process. That process consists of interactive logon and network authentication.
When a user logs on to a computer, the interactive logon process authenticates the user's logon, which confirms the user's identity to the local computer and grants access to Active Directory directory service. Afterward, whenever the user accesses network resources, network authentication is used to determine whether the user has permission to do so.
Windows 2000 supports many different network authentication protocols. The key protocols are

• Kerberos V 5 A standard Internet protocol for authenticating users and systems. It's the primary authentication mechanism for Windows 2000.
• NT LAN Manager (NTLM) The primary Windows NT authentication protocol. It's used to authenticate computers in a Windows NT domain.
• Secure Socket Layer/Transport Layer Security (SSL/TLS) The primary authentication mechanism used when accessing secure Web servers.

A key feature of the Windows 2000 authentication model is that it supports Single Sign-On. Single Sign-On works in the following way:

1. A user logs on to the domain by using a logon name and password or by swiping a smart card into a card reader.
2. The interactive logon process authenticates the user's access. With a local account, the credentials are authenticated locally and the user is granted access to the local computer. With a domain account, the credentials are authenticated in Active Directory and the user has access to network resources.
3. Now the user can authenticate to any computer in the domain through the network authentication process. With domain accounts, the network authentication process is automatic (through Single Sign-On). With local accounts, on the other hand, users must provide a user name and password every time they access a network resource.

Access Controls

Active Directory is object-based. Users, computers, groups, shared resources, and many other entities are all defined as objects. Access controls are applied to these objects with security descriptors. Security descriptors do the following:

• List the users and groups that are granted access to objects
• Specify permissions the users and groups have been assigned
• Track events that should be audited for objects
• Define ownership of objects

Individual entries in the security descriptor are referred to as access control entries (ACEs). Active Directory objects can inherit ACEs from their parent objects. This means that permissions for a parent object can be applied to a child object. For example, all members of the Domain Admins group inherit permissions granted to this group.
When working with ACEs, keep the following points in mind:

• Access control entries are created with inheritance enabled by default.
• Inheritance takes place immediately after the ACE is written.
• All access control entries contain information specifying whether the permission is inherited or explicitly assigned to the related object.

Top of page

Differences Between User and Group Accounts

Windows 2000 provides user accounts and group accounts (of which users can be a member). User accounts are designed for individuals. Group accounts are designed to make the administration of multiple users easier. While you can log on to user accounts, you can't log on to a group account. Group accounts are usually referred to simply as groups.

User Accounts

In Windows 2000 two types of user accounts are defined:

• Domain user accounts Users accounts defined in Active Directory are called domain user accounts. Through Single Sign-On, domain user accounts can access resources throughout the domain. Domain user accounts are created in Active Directory Users And Computers.
• Local user accounts User accounts defined on a local computer are called local user accounts. Local user accounts have access to the local computer only, and they must authenticate themselves before they can access network resources. You create local user accounts with the Local Users And Groups utility.

Note: Only member servers and workstations have local user and group accounts. On the initial domain controller for a domain, these accounts are moved from the local security manager to Active Directory and then become domain accounts.
Logon Names, Passwords, and Public Certificates
All user accounts are identified with a logon name. In Windows 2000, this logon name has two parts:

• User name The text label for the account
• User domain or workgroup The workgroup or domain where the user account exists

For the user WRSTANEK, whose account is created in the MICROSOFT.COM domain, the full logon name for Windows 2000 is wrstanek@microsoft.com.
The pre-Windows 2000 logon name is MICROSOFT\wrstanek.
When working with Active Directory, you may also need to specify the fully qualified domain name for a user. The fully qualified domain name for a group is the combination of the Domain Name Service (DNS) domain name, the container or organizational unit location, and the group name. For the user Microsoft.com\Users\wrstanek, Microsoft.com is the DNS domain name, Users is the container or organizational unit location, and wrstanek is the user name.
User accounts can also have passwords and public certificates associated with them. Passwords are authentication strings for an account. Public certificates combine a public and private key to identify a user. You log on with a password interactively. You log on with a public certificate using a smart card and a smart card reader.
Security Identifiers and User Accounts
Although Windows 2000 displays user names to describe privileges and permissions, the key identifiers for accounts are security identifiers (SIDs). SIDs are unique identifiers that are generated when accounts are created. SIDs consist of the domain's security ID prefix and a unique relative ID, which was allocated by the relative ID master.
Windows 2000 uses these identifiers to track accounts independently from user names. SIDs serve many purposes. The two most important ones are to allow you to easily change user names and to allow you to delete accounts without worrying that someone may gain access to resources simply by re-creating an account.
When you change a user name, you tell Windows 2000 to map a particular SID to a new name. When you delete an account, you tell Windows 2000 that a particular SID is no longer valid. Afterward, even if you create an account with the same user name, the new account will not have the same privileges and permissions as the previous one. That's because the new account will have a new SID.

Groups

In addition to user accounts, Windows 2000 provides groups. You use groups to grant permissions to similar types of users and to simplify account administration. If a user is a member of a group that can access a resource, that particular user can access the same resource. Thus, you can give a user access to various work-related resources just by making the user a member of the correct group. Note that while you can log on to a computer with a user account, you can't log on to a computer with a group account.
Because different Active Directory domains may have groups with the same name, groups are often referred to by DOMAIN\GroupName, such as WORK\ GMarketing for the GMarketing group in the WORK domain. When you work with Active Directory, you may also need to specify the fully qualified domain name for a group. The fully qualified domain name for a group is the concatenation of the DNS domain name, the container or organizational unit location, and the group name. For the group Microsoft.com\Users\Gmarketing, Microsoft.com is the DNS domain name, Users is the container or organizational unit location, and GMarketing is the group name.
Real World Employees in a marketing department probably need access to all marketing-related resources. Instead of granting access to these resources individually, you could make the users members of a marketing group. That way, they automatically obtain the group's privileges. Later, if a user moves to a different department, you simply remove the user from the group and all access permissions are revoked. Compared to having to revoke access for each individual resource, this technique is pretty easy—so you'll want to use groups whenever possible.
Group Types
In Windows 2000, there are three types of groups:

• Local groups Groups that are defined on a local computer. Local groups are used on the local computer only. You create local groups with the Local Users And Groups utility.
• Security groups Groups that can have security descriptors associated with them. You define security groups in domains using Active Directory Users And Computers.
• Distribution groups Groups that are used as e-mail distribution lists. They can't have security descriptors associated with them. You define distribution groups in domains using Active Directory Users And Computers.

Group Scope
Groups can have different scopes—domain local, built-in local, global, and universal. That is, the groups have different areas in which they are valid.

• Domain local groups Groups that are used to grant permissions within a single domain. Members of domain local groups can include only accounts (both user and computer accounts) and groups from the domain in which they are defined.
• Built-in local groups Groups that have a special group scope that have domain local permissions and, for simplicity, are often referred to as domain local groups. The difference between built-in local groups and other groups is that built-in local groups can't be created or deleted. You can only modify built-in local groups. References to domain local groups apply to built-in local groups unless otherwise noted.
• Global groups Groups that are used to grant permissions to objects in any domain in the domain tree or forest. Members of global groups can include only accounts and groups from the domain in which they are defined.
• Universal groups Groups that are used to grant permissions on a wide scale throughout a domain tree or forest. Members of global groups include accounts and groups from any domain in the domain tree or forest.

Best Practice Universal groups are very useful in large enterprises where you have multiple domains. If you plan properly, you can use universal groups to simplify system administration. Members of universal groups shouldn't change frequently. Each time you change the members of a universal group, you need to replicate these changes to all the global catalogs in the domain tree or forest. To cut down on changes, assign other groups to the universal group rather than accounts. For more information, see the section entitled "When to Use Domain Local, Global, and Universal Groups."
When you work with groups, there are many things you can and can't do based on the scope of the group. A quick summary of these items is shown in Table 7-1. For complete details on creating groups, see Chapter 8, "Creating User and Group Accounts."
Table 7-1 How Group Scope Affects Group Capabilities

Group Capability	Domain Local Scope	Global Scope	Universal Scope
Native Mode Membership	Accounts, global groups, and universal groups from any domain; domain local groups from the same domain only.	Only accounts from the same domain and global groups from the same domain.	Accounts from any domain, as well as groups from any domain regardless of scope.
Mixed Mode Membership	Accounts and global groups from any domain.	Only accounts from the same domain.	Can't be created in mixed-mode domains.
Member Of	Can be put into other domain local groups and assigned permissions only in the same domain.	Can be put into other groups and assigned permissions in any domain.	Can be put into other groups and assigned permissions in any domain.
Scope Conversion	Can be converted to universal scope, provided it doesn't have as its member another group having domain local scope.	Can be converted to universal scope, provided it's not a member of any other group having global scope.	Can't be converted to any other group scope.

Security Identifiers and Group Accounts
As with user accounts, Windows 2000 uses unique security identifiers to track group accounts. This means that you can't delete a group account, re-create it, and then expect all the permissions and privileges to remain the same. The new group will have a new security identifier and all the permissions and privileges of the old group will be lost.
Windows 2000 creates a security token for each user logon. The security token specifies the user account ID and the SIDs of all the security groups to which the user belongs. The token's size grows as the user is added to additional security groups. This has several consequences:

• The security token must be passed to the user logon process before logon can be completed. Because of this, as the number of security group memberships grows, the logon process takes longer.
• To determine access permissions, the security token is sent to every computer that the user accesses. Because of this, the size of the security token has a direct impact on the network traffic load.

Note: Distribution group memberships aren't distributed with security tokens. Because of this, distribution group memberships don't affect the token size.
When to Use Domain Local, Global, and Universal Groups
Domain local, global, and universal groups provide a lot of options for configuring groups in the enterprise. Although these group scopes are designed to simplify administration, poor planning can make these group scopes your worst administration nightmare. Ideally, you'll use group scopes to help you create group hierarchies that are similar to your organization's structure and the responsibilities of particular groups of users. The best uses for domain local, global, and universal groups are as follows:

• Domain local groups Groups with domain local scope have the smallest extent. Use groups with domain local scope to help you manage access to resources, such as printers and shared folders.
• Global groups Use groups with global scope to help you manage user and computer accounts in a particular domain. Then you grant access permissions to a resource by making the group with global scope a member of the group with domain local scope.
• Universal groups Groups with universal scope have the largest extent. Use groups with universal scope to consolidate groups that span domains. Normally, you do this by adding global groups as members. Now when you change membership of the global groups, the changes aren't replicated to all the global catalogs. This is because the membership of the universal group didn't change.

Tip If your organization doesn't have two or more domains, you don't really need to use universal groups. Instead, build your group structure with domain local and global groups. Then, if you ever bring another domain into your domain tree or forest, you can easily extend the group hierarchy to accommodate the integration.
To put this in perspective, consider the following scenario. Say that you have branch offices in Seattle, Chicago, and New York. Each office has its own domain, which is a part of the same domain tree or forest. These domains are called SEATTLE, CHICAGO, and NY. You want to make it easy for any administrator (from any office) to manage network resources, so you create a group structure that is very similar at each location. Although the company has marketing, IT, and engineering departments, let's focus on the structure of the marketing department. At each office, members of the marketing department need access to a shared printer called MarketingPrinter and a shared data folder called MarketingData. You also want users to be able to share and print documents. For example, Bob in Seattle should be able to print documents so that Ralph in New York can pick them up on his local printer, and Bob should also be able to access the quarterly report on the shared folder at the New York office.
To configure the groups for the marketing departments at the three offices, you would follow these steps:

1. Start by creating global groups for each marketing group. On the SEATTLE domain, create a group called GMarketing and add the members of the Seattle marketing department to it. On the CHICAGO domain, create a group called GMarketing and add the members of the Chicago marketing department to it. On the NY domain, create a group called GMarketing and add the members of the New York marketing department to it.
2. In each location, create domain local groups that grant access to the shared printers and shared folders. Call the printer group LocalMarketingPrinter. Call the New York shared folder LocalMarketingData. The SEATTLE, CHICAGO, and NY domains should each have their own local groups.
3. Create a group with universal scope called UMarketing on the domain at any branch office. Add SEATTLE\GMarketing, CHICAGO\Gmarketing, and NY\GMarketing to this group.
4. Add UMarketing to the LocalMarketingPrinter and LocalMarketingData groups at each office. Marketing users should now be able to share data and printers.

Understanding Group Types and Scopes



An Introduction to Groups

A group can be defined as a collection of accounts that are grouped together so that Administrators can assign permissions and rights to the group as a single entity. This removes the need for an Administrator to individually assign permissions and rights to each account. Therefore, while a user account is associated with an individual, or one entity; a group account or a group, is created to simplify the administration of multiple user accounts (users). When you grant permissions to a group, all accounts that are part of that particular group are granted the permissions. Permissions actually controls which actions users can perform on a network resource. Rights on the other hand relate to system tasks.
Windows Server 2003 provides user accounts and group accounts (of which users can be a member). User accounts are designed for individuals. Group accounts are designed to make the administration of multiple users easier.
The following entities can be added to groups:

• User accounts
• Computer accounts
• Contacts
• Other group's members
• Other groups

The administrative tasks typically performed on groups are summarized below:

• Assign permissions to groups to access shared resources. Each group member would be able to access the shared resources.
• Assign rights to groups so that they can perform certain system tasks such as backing up or restoring files.
• Groups are also used to distribute bulk e-mail to its members.

You have to specify a group type and a group scope when you create a new group. Group types and group scopes are discussed throughout the remainder of this Article.

Group Types

You can create two types of groups in Active Directory. Each group type is used for a different purpose. Security groups are the group type which is created for security purposes, while distribution groups is the group type created for purposes other than security purposes. Security groups are typically created for assigning permissions, while distribution groups are usually created for distributing bulk e-mail to users. As you can see, the main difference between the two groups is the manner in which each group type is used. Active Directory does however allow you to convert a security group to a distribution group, and to convert a distribution group to a security group if the domain functional level is raised to Windows 2000 Native or above.

• Security groups: A security group is a collection of users who have the same permissions to resources, and the same rights to perform certain system tasks. These are the groups to which you assign permissions so that its members can access resources. Security groups therefore remove the need for an Administrator to individually assign permissions to users. Users that need to perform certain tasks can be grouped in a security group, and then assigned the necessary permissions to perform these tasks. Each user that is a member of the group would have the same permissions. In addition to this, any e-mail sent to a security group is received by each member of that particular group. When a security group is first created, it receives a SID. It is this SID that enables permissions to be assigned to security groups – the SID can be included in the DACL of a resource. An access token is created when a user logs on to the system. The access token contains the SID of the user, and the SID of those groups to which the user is a member of. This access token is referenced when the user attempts to access a resource – the access token is compared with the DACL of the resource to determine which permissions the user should receive for the resource.
• Distribution groups: Distribution groups are created to share information with a group of users through e-mail messages. Thus, a distribution group is not created for security purposes. A distribution does not obtain a SID when it is created. Distribution groups enable the same messag to be simultaneously sent to its group members – messages do not need to be individually sent to each user. Applications such as Microsoft Exchange that work with Active Directory can use distribution groups to send bulk e-mail to groups of users.

Group Scopes

The different group scopes make it possible for groups to be used differently to assign permissions for accessing resources. The scope of a group defines the place in the network where the group will be used or is valid. This is the degree to which the group will be able to reach across a domain, domain tree, or forest. The group scope also determines what users can be included as group members.
In Active Directory, there are three different group scopes.

• Global groups: Global groups are containers for user accounts and computers accounts in the domain, and are used to assign permissions to objects that reside in any domain in a tree or forest. You can include a global group in the access control list (ACL) of objects in any domain in the tree/forest. A global group can however only have members from the domain in which it is created. What this means is that a global group cannot include user accounts, computer accounts, and global groups from other domains.
  The domain functional level set for the domain determines which members can be included in the global group.
  
  • Windows 2000 Mixed: Only user accounts and computer accounts from the domain in which the group was created, can be added as group members.
  • Windows 2000 Native / Windows Server 2003: User accounts, computer accounts, and other global groups from the domain in which the group was created, can be added as group members
• Domain Local groups: Domain local groups can have user accounts, computer accounts, global groups, and universal groups from any domain as group members. However, you can only use domain local groups for assigning permissions to local resources, or to resources that reside in the domain in which the domain local group was created. This means that you can only include domain local groups in the ACL of objects that are located in the local domain.
  The domain functional level set for the domain determines which members can be included in the domain local group.
  
  • Windows 2000 Mixed: User accounts, computer accounts, and global groups from any domain can be added as group members.
  • Windows 2000 Native / Windows Server 2003: User accounts, computer accounts, global groups, and universal groups from any domain can be added as group members. You can also add other domain local groups from the same domain as group members.
• Universal groups: Universal groups can have user accounts, computer accounts, global groups, and other universal groups, from any domain in the tree or forest as members. This basically means that you can add members from any domain in the forest to a universal group. You can use universal groups to assign permissions to access resources that are located in any domain in the forest. Universal groups are only available when the domain functional level for the domain is Windows 2000 Native or Windows Server 2003. Universal groups are not available when domains are functioning in the Windows 2000 Mixed domain functional level. You can convert a universal group to a global group or to a domain local group if the particular universal group has no other universal group as a group member. When adding members to universal groups, it is recommended to add global groups as members and not individual users.

When groups contain other groups as members, group nesting occurs. Group nesting occurs when you add groups to other groups. Group nesting assists in reducing the number of instances that you need to assign permissions, and in reducing replication traffic. As mentioned previously, the domain functional level set for the domain determines what group nesting can be implemented, as summarized below:

• Windows 2000 Mixe:
  
  • Global groups: User accounts and computers accounts in the same domain.
  • Domain local groups: User accounts, computers accounts, and global groups from any domain.
• Windows 2000 native or Windows Server 2003:
  
  • Global groups: User accounts, computer accounts, and other global groups in the same domain.
  • Domain local groups: User accounts, computers accounts, global groups and universal groups from any domain; and other domain local groups in the same domain.
  • Universal groups: User accounts, computers accounts, global groups, and universal groups from any domain.

The scope of a group can be changed as well. You can use the Active Directory Users And Computers (ADUC) console to view and modify the scope of an existing group. The command-line can also be used – dsget and dsmod. The rules that govern this capability are summarized below:

• You can convert domain local groups and global groups to universal groups
• You can convert universal groups to domain local groups or to global groups.
• You cannot convert domain local groups to global groups.
• You cannot convert global groups to domain local groups.

If you are using Windows Server 2003 Active Directory, Windows Server 2003 creates a few default security groups that are used to assign administrative permissions to users. The default security groups are created in the Users folder in Active Directory Users And Computers (ADUC).

• The default domain local groups that are created are listed below:
  
  • Cert Publishers: Members of this group are able to publish certificates to Active Directory
  • DnsAdmins: Group members have administrative access to the DNS server service.
  • HelpServicesGroup: Group members are able to assign rights to support applications.
  • RAS and IAS Servers: Servers assigned to this default group can access a user's remote access properties.
  • TelnetClients: Group members have administrative access to Telnet Server.
• The default global groups that are created are listed below:
  
  • Domain Admins: Members of the Domain Admins group have permissions to perform administrative functions on computers in the domain.
  • Domain Users: Group members are user accounts that are created in the domain.
  • Domain Computers: Group members are computer accounts that are created in the domain. This includes all workstations and servers that are part of the domain.
  • Domain Controllers: Group members are domain controllers of the domain.
  • Domain Guests: Group members are guest accounts in the domain.
  • Group Policy Creator: Group members are able to change the domain's group policy.
  • DnsUpdateProxy: Group members are DNS clients. Members are able to perform dynamic updates for clients such as DHCP servers.
• The default universal groups that are created are listed below:
  
  • Enterprise Admins: Members of this group are able to perform administrative functions for the whole network.
  • Schema Admins: Members of this group can perform administrative tasks on the schema.

When formulating a strategy for setting up domain local groups and global groups, follow the guidelines listed below:

• You should add users that perform the same function in the organization to a global group.
• Domain local groups should be created for a resource(s) that needs to be shared by multiple users.
• You should then add any global groups that have to access a resource(s) to the appropriate domain local group.
• The domain local group should be assigned with the proper permissions to the resource.

In addition to the above mentioned group scopes, another group called a local group, can be created. A local group is basically used on the local computer to assign permissions to resources that are located on the computer on which the particular local group is created. Local groups are created in the local security database and are not present in Active Directory. This means that you cannot create local groups on domain controllers.

How to create a group

You can use the Active Directory Users And Computers console to create a new group. After the group is created, you can set additional properties for the group, and add members to the group.
To create a new group,

1. Click Start, Administrative Tools, and then Active Directory Users And Computers.
2. Right-click the particular domain, organizational unit, or container in which you want to place the new group, and select New, and then Group from the shortcut menu.
3. The New Object-Group dialog box opens next.
4. In the Group Name box, enter a name for the new group. You can specify a name as long as 64 characters.
5. The Group Name (Pre-Windows 2000) box is automatically populated with the first 20 characters of the group name that you specified.
6. In the Group Scope box, select one of the following options as the group scope: Domain Local, Global, or Universal.
7. In the Group Type box, select one of the following options as the group type: Security or Distribution.
8. Click OK.

How to add multiple members to a group

1. Click Start, Administrative Tools, and then Active Directory Users And Computers.
2. Expand the particular domain, organizational unit, or container that contains the group that you want to add members to.
3. Locate and right-click the group, and then select Properties from the shortcut menu.
4. When the Properties dialog box opens, click on the Members tab.
5. Click Add.
6. When the Select Users, Contacts, Computers, Or Groups dialog box opens, click the Advanced button.
7. Click the Find Now button and select the user accounts, group accounts, or computer accounts that should be added to the particular group. If you want to select multiple users, groups, or computers, simply hold down the Shift or Ctrl key.
8. Click OK.
9. Each account that you have selected now appears in the Enter The Object Names To Select box.
10. Click OK to add the members to the group.
11. Click OK in the Properties dialog box for the group.

How to manage group membership individually

1. Click Start, Administrative Tools, and then Active Directory Users And Computers.
2. Double-click the user, group, or computer account that you want to work with.
3. When the Properties dialog box opens, click the Members Of tab.
4. If you want to add this particular account as a member of a group, click Add.
5. When the Select Groups dialog box opens, select the groups that this account should be member of.
6. If you want to remove the account from a group, simply click Remove
7. Click OK.

How to delete a group

When it comes to deleting a group, you should remember the following points:

• When a security group is created, it receives a unique SID. When you delete a group, the SID of that particular group is never used again, even if you create a group with the same name at a later stage.
• When a group is deleted, the following are deleted:
  
  • The actual group being deleted
  • All permissions/rights associated with the particular group being deleted
• When a group is deleted, the following are not deleted:
  
  • Any user accounts and computer accounts that are members of the particular group.

Use the steps listed below to delete a group,

1. Click Start, Administrative Tools, and then Active Directory Users And Computers.
2. Expand the particular domain, organizational unit, or container that contains the group that you want to delete.
3. Locate and right-click the group, and then select Delete from the shortcut menu.
4. Click Ys to verify that you want to delete the particular group.

How to change the group scope of an existing group

You can change the group scope of existing groups when the domain functional level is set to Windows 2000 native or Windows Server 2003.

1. Click Start, Administrative Tools, and then Active Directory Users And Computers.
2. Expand the particular domain, organizational unit, or container that contains the group that you want to change the group scope for.
3. Locate and right-click the group, and then select Properties from the shortcut menu.
4. When the Properties dialog box opens, on the General tab, change the group scope in the Group Scope box to either Domain Local, Global, or Universal.
5. Click OK.

How to change the group type of an existing group

You can convert a group's type from being a security group to a distribution group, or from being a distribution group to a security group

1. Click Start, Administrative Tools, and then Active Directory Users And Computers.
2. Expand the particular domain, organizational unit, or container that contains the group that you want to change the group type for.
3. Locate and right-click the group, and then select Properties from the shortcut menu.
4. When the Properties dialog box opens, on the General tab, change the group type in Group Type box to either Security or Distribution.
5. Click OK

How to manage group scope, group type, and group membership using the command-line

You can use dsget group to determine and view the properties of groups in Active Directory.

• To determine the scope of a group, use the syntax listed below:
  
  • dsget group -scope
• To determine the group type of a group, use the syntax listed below:
  
  • dsget group -secgrp
• To determine the members of a particular group, use the syntax listed below:
  
  • dsget group -members
• To determine a group's membership, use the syntax listed below:
  
  • dsget group -memberof

You can use dsmod group to change the properties of groups in Active Directory.

• To change a group's type, use the syntax listed below:
  
  • dsmod group GroupDN [-secgrp {yes | no}]
• To change a add new members to a group, use the syntax listed below:
  
  • dsmod group GroupDN -addmbr UserDN
• To remove existing members from a group, use the syntax listed below:
  
  • dsmod group GroupDN -rmmbr UserDN

Cannot start Microsoft Outlook. Unable to open the Outlook window. The set folders could not be opened. The server is not available. Contact your administrator if this condition persists

Actually, this issue occurs as the current navigation pane in Outlook is not working properly. We can try to use the command "Outlook.exe /resetnavpane" to clear and regenerate the navigation pane for the current Outlook profile.

To run this command, click the Start pearl, in the Search box, type command. Right click on Command Prompt and press Enter. Run the following command in the Command Prompt:

"C:\Program Files\Microsoft Office\Office 14\Outlook.exe" /resetnavpane

Note: I assumed that your Office program is installed in C:\Program Files. If it is installed in other path, you can change the path.

If the problem persists after this, the best method is to create a new Outlook profile.

Method 3 : Command
Click Start>Run. In the Open field, enter > > outlook.exe /resetfolders > > Click OK. Make sure you include the space before the slash
Method 4 : Command Line Run Outlook from a command line with the /cleanprofile switch appended to the command. To find the correct command line, right click on a shortcut for Outlook and go to Properties. Copy the information in the Target field and Paste it to the command line. If there is already a command option, remove it and add /cleanprofile after the closing quotation mark. (Add a space before /cleanprofile) For example, go to Start: Run. . and enter something like "C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE" /cleanprofile . Then add a new profile. Be sure to check the check box for "Set as default profile". Note: You cannot see this option unless you click on the "Options >>" button

Method 2: Delete the registry key

To do this, follow these steps.

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

322756 (http://support.microsoft.com/kb/322756/) How to back up and restore the registry in Windows

1.	Click Start, click Run, type regedit, and then click OK.
2.	Locate one of the following registry keys, as appropriate for the version of Microsoft Windows that you are using: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem
3.	Delete the Profiles key under the Windows Messaging (Subsystem) key. To do this, right-click Profiles, and then click Delete. Click Yes to confirm the deletion.
4.	Exit Registry Editor, and then restart Outlook.

Create a New Global Address List with a Custom Search by Using an LDAP Filter

Use the Exchange System Manager Utility

To use Exchange System Manager to run an LDAP query to create a custom search, follow these steps:

1. Start the Exchange Server 2003 System Manager utility.
2. Expand Recipients, right-click All Address Lists, point to New, and then click Address List.
3. In the Address List name box, type a descriptive name for the address list, and then click Filter Rules.
4. In the Find list, click Custom Search.
5. Click the Advanced tab.
6. Type the LDAP query. For example, type givenname=firstname (where firstname is the first name of the user who you want to find).
   
   Note This query field is limited and may not be sufficient for the length of the LDAP query that you want to perform.
7. Click OK, and then click Finish.

The new address list that contains the custom LDAP query is saved under All Address Lists.

Back to the top

Use the ADSI Edit Utility

Warning If you use the ADSI Edit snap-in, the LDP utility, or any other LDAP version 3 client, and you incorrectly modify the attributes of Active Directory objects, you can cause serious problems. These problems may require you to reinstall Microsoft Windows 2000 Server, Microsoft Windows Server 2003, Microsoft Exchange 2000 Server, or both Windows and Exchange 2000 Server. Microsoft cannot guarantee that problems that occur if you incorrectly modify Active Directory object attributes can be solved. Modify these attributes at your own risk. Note You can use the ADSI Edit snap-in to work around the 256-character limit of the Exchange System Manager LDAP query.

1. Start the ADSI Edit utility. This utility is included on the Windows 2000 Server CD-ROM or the Windows Server 2003 CD-ROM. To install the ADSI Edit utility on a Windows 2000-based system, run Setup.exe from the Support\Tools folder on the Windows 2000 CD-ROM. On a Windows Server 2003-based system, right-click Suptools.msi in the Support\Tools folder on the Windows Server 2003 CD-ROM, and then click Install. To start this utility, click Start, click Run, type adsiedit.msc, and then click OK.
2. Expand the Configuration container, and then expand CN=Configuration,DC=example,DC=com (where example.com is the name of your domain).
3. Expand CN=Services, expand CN=Microsoft Exchange, expand CN=OrganizationName (where OrganizationName is the name of your organization), expand CN=Address Lists Container, and then expand CN=All Address Lists.
4. Right-click the address list where you want to create a custom LDAP search, and then click Properties.
5. In the Attributes list, click purportedSearch, and then click Edit.
6. In the Value box, type the LDAP query that you want, and then click OK.
7. Click Apply, click OK, and then quit the ADSI Edit utility.

You may have to force replication between domain controllers to activate this new query.

LDAP Address Book as Setting Up Active Directory

Active Directory is a robust tool, capable of many things. This article will only look at a small portion of the tool: Being an LDAP (lightweight directory access protocol) Server.
Let's say you use many computers and you send email from all of them. How do you keep your address books in sync? How do you make sure you have all of your addresses available no matter which machine you are using?
LDAP is the answer. LDAP is designed just for things like this. The idea is you have an address book "server" which will hold all of your addresses. As long as you are using an LDAP-capable email client you'll be all set.
The only challenge is to setup an LDAP server. Windows Server 2003 comes with Active Directory - an LDAP server. It does not install by default, so the first thing to do is to setup Active Directory (AD). There is a great article that will explain how to set it up here: http://www.petri.co.il/how_to_install_active_directory_on_windows_2003.htm.
Once you have AD installed, the rest is pretty easy, though not obvious.
First thing is to open Active Directory Users and Computers (under Adminstrative tools). You'll see something like this:

Next thing you need to do is to create an Organizational Unit (OU) to hold all the contacts. We'll call this Contacts.

Now, if you want to have each user have their own collection of addresses, it's a good idea to add an OU for each user under the new Contacts OU.

Now, you just need to add some contacts into your OU.
At this point, you are done with the server. Now you just need to configure the email client. Here, we will use Thunderbird from Mozilla.
From within Thunderbird, go to Tools -> Options and select Composition on the left. Then, make sure the Directory Server checkbox is checked. and click Edit Directories.
When the LDAP Directory Servers dialog comes up, click the Add button and complete the form with your own values:

• Name: Any name you like 
• Hostname: The address of the LDAP server [could be an IP address] 
• Base DN: Depends on the structure you used in the Active Directory Users and Computer admin tool. Here we used [OU=TestUser1Contacts,OU=Contacts,dc=activedirectorytester,dc=com] 
• Port number: 389 by default - normally you will not need to change this 
• Bind DN: Your email address which is also your Windows 2003 Server login name

Of course, you will need to use values that match your server but you should be able figure out the changes easily enough.
To test your setup, just create a new email and type a partial name of one of the contacts you added. Below I entered: Jane D

You can see the LDAP server is returning the information for Jane Doe. You might also notice that the icon next to her name is a little different than normal. This is the indicator that the data is coming from an LDAP server.
TROUBLESHOOTING
Hopefully, you have not run into any troubles but if you do, you should check a few things. The first thing you should check is to see if your client has connectivity to the LDAP server. There is a tool that should be on the LDAP server named LDP.exe. You can find it under your Program Files folder in Support Tools. Bring this application to your client and try to connect to your server using the appropriate settings.
Using the Connection menu, Connect, then Bind. When you Bind, in the User textbox, just put your username with out the domain (TestUser1 for the data above). Check the Domain checkbox, enter your password for the server, and enter the domain (ActiveDirectoryTester.com for the data above).
Next, use the Browse menu and select Search. Enter your Base DN (OU=TestUser1Contacts,OU=Contacts,dc=activedirectorytester,dc=com for the above data), make sure the Scope is set to SubTree, and click Run. You should get back results. If not, start back at the beginning and check every step, perhaps you missed something small

Configure MX Records for Incoming SMTP E-Mail Traffic