Universal v global.

[BINZA@]

Could anyone explain why you would use universal group for 3 but not for 2
as they are on different domains. I think im missing something very simple
here but the more i read this and try to understand the more i get confused.
Also why use universal for 3 when you can use global ?
Any answers will be gratefully received.


Scenario:
You are an infrastructure planner on the Active Directory infrastructure
design team for The Ski Haus, an international retailer of ski apparel. The
Ski Haus uses two domains, one for resources at their Denver, Colorado,
location and another for resources at their Geneva, Switzerland, location.

The Product Design department at each location maintains a separate database
of ski hat designs. Product Design users at each location must have full
control of the ski hat design database in their own domain. Product Design
users at both locations must have read permissions on both ski hat design
databases. Product Design users at both locations must have change
permissions on the ski sweater design database in the Geneva location.

1.. Explain how your design team will use security groups to allow the
Product Design users in each domain full control of the ski hat design
databases in their domains.
Set up a Denver Product Design global group and add the Denver Product
Designer users to the group. Set up a Geneva Product Design global group and
add the Geneva Product Designer users to the group. Then add the Denver
Product Design global group to a Denver Product Design domain local group
and add the Geneva Product Design global group to a Geneva Product Design
domain local group. Grant full control permissions for the ski hat design
database to each domain local group.

2.. Explain how your design team will use security groups to allow the
Product Design users in each domain read permission to the Denver and Geneva
ski hat design databases.
Set up a Denver domain local group that has read permission for the ski
hat design database. Add the Geneva Product Design global group to the
Denver domain local group. Set up a Geneva domain local group that has read
permission for the ski hat design database. Then add the Denver Product
Design global group to the Geneva domain local group.

3.. Explain how your design team will use security groups to allow all
Product Design users in both domains change permission to the ski sweater
design database in Geneva.
Set up a universal group. Set up a domain local group in the Geneva
domain that has change permission for the ski sweater design database. Add
the Geneva Product Design global group and the Denver Product Design global
group to the universal group. Add the universal group to a domain local
group in Geneva.

 

[Joe Richards [MVP]]

Someone was stupid, you don't need the universal group in 3. Also I wouldn't use
the global's at all. I would do it all with DLGs as there security implications
to using the nesting of global into local groups like that as the person
controlling the resource no longer has direct control over who has access.
Whomever controls the global groups has the control.

joe

 

[BINZA@]

Thanks Joe,
Confirmation of my own thougts.
However surely you have to nest global group into DLG to enable users from
other domain to access the resource. I thought the only way for users to use
objects in different domain where by traveling across in a global group or
universal group.