MCSA/MCSE Self-Paced Training Kit (Exam 70-270): Installing ...

F07us10
Assign permissions
once for a group
Group
permissions
Figure 7-10 Groups simplify administration.
Guidelines for Using Local Groups
- instead of -
Resources
Groups are collections of user accounts.
Members receive permissions given to groups.
Users can be members of multiple groups.
Groups can be members of other groups.
7-37
A local group is a collection of user accounts on a computer. Use local groups to assign
permissions to resources residing on the computer on which the local group is created.
Windows XP Professional creates local groups in the local security database.
Guidelines for using local groups include the following:
Lesson 5 Implementing Groups
Assign permissions for
each user account
permissions
permissions
permissions
■ Before creating a new group, determine whether a built-in group (or other existing
group) fits your needs. For example, if all users need access to a resource, use
the built-in Users group.
■ Use local groups on computers that do not belong to a domain. You can use local
groups only on the computer on which you create them. Although local groups
are available on member servers and domain computers running Windows 2000
Server or later, do not use local groups on computers that are part of a domain.
Using local groups on domain computers prevents you from centralizing group
administration. Local groups do not appear in the Active Directory service, and
you must administer them separately for each computer.
■ You can assign permissions to local groups to access only the resources on the
computer on which you create the local groups.
Note You cannot create local groups on domain controllers because domain controllers
cannot have a security database that is independent of the database in Active Directory.
User
User
User