On networks with redundant data servers, you can end up permissioning the same users two or three times if you permission the users directly to the data share. A better way to do this is to create a Global group on the domain controller for, let's say, the accounting department.
We will call the Global group "Global_Accounting." On the individual data servers, create local accounts called "Local_Accounting." Permission each Local_Accounting group with the Global_Accounting group.
Now, permission each Accounting share on each redundant data server with their respective Local_Accounting group. Now all you have to do is add each Accounting department user one time to the Global_Accounting group, and all Accounting users will be automatically added to each corresponding Local_Accounting group with the permissions you set up when you added the Local_Accounting group to the Accounting share. This will make it much easier to maintain permissioning and keep things in order.
Requires Free Membership to View
SearchSecurity.com members gain immediate and unlimited access to breaking industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.com today!
Michael S. Mimoso, Editorial Director
This was first published in March 2002