concept permission in category active directory

This is an excerpt from Manning's book Learn Active Directory Management in a Month of Lunches. Login to get full access to this book.

The forest is the security boundary for Active Directory, which means you can’t set permissions outside the forest, and objects outside the forest aren’t granted permissions inside the forest. There are exceptions to those statements where you create trusts to other forests, but we’ll get to that later.

Figure 4.1. Using groups. Put user accounts into Global groups. The Global groups are added to Domain Local groups. Domain Local groups are added to ACLs to give permissions to resources such as file shares.

Viewing permissions