microsoft.public.win2000.security news group, =?Utf-8?B?
UGFjZXIgSGlibGVy?= said:
One more question, can I add these computers that need the permissions to the Application group I created. Then set in the group plicy for it to apply only to that group? Or do I have to enter in all computers on the security tab of the Group policy that I want it to push to.
You're still not getting it. I'll try an example.
Let's say that my application installs to C:\MyApp.
I have 100 users that run this application and they need to have Full
Control permissions on this folder.
This application is installed on 100 computers, and I don't want to have
to manually set the NTFS permissions on those 100 computers.
To simplify the assignment of permissions, I create a group called MyApp
Users and put the 100 user into that group.
Now I create a Group Policy object that defines the NTFS settings for C:
\MyApp such that the MyApp Users group is granted full control.
Now, at this point, if I link this GPO at the domain level, it will
apply to every computer in the domain. Only 100 of those computers
actually have the C:\MyApp folder though. The NTFS permissions on the C:
\MyApp folder on those 100 machines will be MyApp Users with Full
Control after the GPO is processed. Note that since this GPO contains
settings that are processed by computers, these settings will be applied
before anyone even logs into the computer. All of the rest of the
computers in the domain that do not have the C:\MyApps folder will
either ignore the settings, or they may try to process them and log an
error in the event log (can't recall which off the top of my head).
So, now you've got the correct NTFS permissions on the 100 machines that
have MyApp installed, and any of the users in the MyApp Users group will
be able to run the app, and no one else can.
To refine this somewhat, so that this GPO is only processed by the
computers that have MyApp installed, you have two options:
1. Move all of the computers that have this MyApp installed into a new
OU, and then link the GPO with the NTFS settings to that OU.
or
2. Create another group called MyApp Computers, add the 100 computer
accounts that need to process this GPO to that group. Keep the GPO
linked at the domain level. Remove Authenticated Users from the ACL of
this GPO, and add the MyApp Computers group, granting Read and Apply
Group Policy permissions. This way, no matter what OU the computers are
in that have MyApp installed, they will get this GPO, and due to the new
ACL, it will only be processed by computers whose accounts are in the
MyApp Computers group.
You really should read up on how Group Policy works. Microsoft has
excellent white papers on their web site, and on-line help is pretty
good as well.
