Managing Active Directory
Domain admin: The administrators of the Active Directory domain
- Users in the domain admin group can make any changes they want to the domain.
- Since the domain can control the configuration of all of the computers that are bound to it, domain admins can become local administrators of all of those machines too.
Enterprise admin: The administrators of the Active Directory domain that has permission to make changes to the domain that affect other domains in a multi-domain forest
- Enterprise admin accounts should only be needed on a rare occasion, like when active directory forest is being upgraded to a new version
Domain users: A group that contains every user account in the domain
- If you want to give access to a network resource to everyone in the domain, you don’t need to grant access to every individual account, you can use domain users.
- Each computer that’s joined to the domain has an account too, so we have a default group for them also
Domain computers: All the computers joined to the domain except domain controllers
Domain controllers (DC): The service that hosts copies of the Active Directory database
- Domain controllers group contains all domain controllers in the domain.
Domain admin accounts should only be used when you deliberately making changes to active directory
Security account manager (SAM): A database in windows that stores user names and password
Security group: One of the two categories that groups in Active Directories can be part of, they can contain user accounts, computer accounts or other security groups
Distribution group: A group that is only designed to group accounts and contacts for email communication
- You can’t use distribution groups for assigning permission to resources.
- One reason you might use a distribution group instead of a security group is to create an email list that included people from outside of your domain.
Group scope: The way that group definitions are replicated across domains
Domain local: The tool used used to assign permission to a resource
Domain users: A group that contains every user account in the domain
Global: The tool that is used to group accounts into a role
Universal: The tool that is used to group global roles in a forest
- Universal groups are replicated to all domains in a forest.
For more information on Group Scope check out the link here and for Security Principles click here.
For more information on Features of EFS click here
We can join computers to the domain from PowerShell too.
For more information on Forest and Domain Functional Levels click here