Nesting groups?

[Anders]

OK.. this might be a stupid question, but as far as I've been
able to tell, this should work. So, why doesn't it?

We have a mixed mode domain.
In order to reflect a two-lever structure, I have some

Global security groups

who are members of

Domain Local security groups.

The domain local groups are then used to set file permissions
on two file servers, one Win2K and one NT4.

NT4 happily enforces all permissions as set, but the Win2K file server
does not seem to like it. I can add the domain local group to the ACL,
but the server does not enforce the permissions for users that are
members of the global group within it.

Why can't win2k enumerate the list of users in "nested" groups like
this?

and why can't I add domain local groups to file server local groups?

All hints and help appreciated.

Cheers,
Anders RM

 

[Chriss3]

Anders your nesting options depend on whether the domain is in native mode
or mixed-mode.

Nesting Groups in Windows2000:
http://www.microsoft.com/windows2000/en/server/help/sag_ADgroupsNesting.htm

 

[Anders]

Anders your nesting options depend on whether the domain is in native mode
or mixed-mode.

Thanks, Chris

but as the link you provided says,
"Groups with domain local scope can
have as their members other groups with
global scope and accounts".

This is what I have.
The problem occurs when adding these groups to /server/ local groups, in
which case
it seems to accept the domain local group, but ignores the members of the
global group within it.

Cheers,
Anders

 

[Chriss3]

How dose it not accept the members of the global group?

 

[Anders]

Anders your nesting options depend on whether the domain is in native mode
or mixed-mode.

Thanks Chris, but I've nested my groups as described in the document you
provided a link to.

My problem arises when I include those groups in a server local group.
The server seems to enumerate users in the domain local group, but not
the global group within it.

(my apologies if this reply went to your email first, I think I may have hit
the wrong button)

Cheers,
Anders

 

[Anders]

How dose it not accept the members of the global group?

It simply ignores them. Members of those groups do not get
access to their files.

Cheers,
Anders