On networks with redundant data servers, you can end up permissioning the same users two or three times if you permission the users directly to the data share. A better way to do this is to create a Global group on the domain controller for, let's say, the accounting department.
We will call the Global group "Global_Accounting." On the individual data servers, create local accounts called "Local_Accounting." Permission each Local_Accounting group with the Global_Accounting group.
Now, permission each Accounting share on each redundant data server with their respective Local_Accounting group. Now all you have to do is add each Accounting department user one time to the Global_Accounting group, and all Accounting users will be automatically added to each corresponding Local_Accounting group with the permissions you set up when you added the Local_Accounting group to the Accounting share. This will make it much easier to maintain permissioning and keep things in order.
This was first published in March 2002