Assigning Permissions - AGDLP

AGDLP

It seems I have been mildly distracted away from the title of this blog site.  It does say AD Admin, but I seem to have been taken away by file system stuff.  I have to say, it has all been worthwhile, but it’s probably time I got back to the real heart of what I do.

There are probably a million permission assigning advice pages, but I thought I would put another one out there after referring to AGDLP in my last post.

So, what is this all about – AGDLP.  Well, it is something I learned in my MCSE 2003 studies and has become ingrained into my ideals since.  As a contractor, I get to move job often.  This enables me to forge opinions on how to configure things in a domain, and more importantly how NOT to configure things.

AGDLP is definitely on the to do list…for anyone in any size domain or forest, as it follows some very basic principals.  I will explain these whilst I go through what AGDPL stands for.

A

A is for account.  It is the security principal that you log in with.  It is the service account that runs a scheduled task on a server.  It is the computer object in AD.

G

G is for Global Group. Basic principal number 1 is represent your user base by a group wherever you can.  If 1 person in sales needs access to a drive, then most likely the others should have access too.

DL

DL is for Domain Local Group.  In the same way that a group represents users, so should a group represent resources.  All access is given to the domain local group, ensuring that junior administrators don’t need to play with the ACL on a drive etc, they only have to add an object (Global Group) to a Domain Local Group.

P

P is for Permission.  As mentioned in DL, permissions are assigned to the DL so that the ACL on an object is as simple as possible.

Example

So, lets walk though an example of this.

John is part of the sales group and the sales people have just been given a huge new server with loads of storage for brochure PDFs.  John is working with the IT team to get everything set up for access for the whole team.

It has been decided that the Global Group “Sales – All Staff” (of which John is a member) is the best representation of the users that need access to the new drive.

A new file share has been created on the Server and a Domain local group called “Sales Brochures – Modify” has been created and assigned Read and Modify NTFS permissions to the file system and has also been given Read and Change Share permissions.

Whilst there, the IT guys created a “Sales Brochures – Read” Domain Local group and gave the group read to both NTFS and Share permissions.

So the A-G-DL-P looks like this :

Account (A)	Global Group (G)	Domain Local (DL)	Permissions (P)
John	Sales – All Staff	Sales Brochures – Modify	Change on share Modify on NTFS
		Sales Brochures – Read	Read on share Read on NTFS

There isn’t yet an A and G for the read only group, but it is very simple to add anyone read access now.

For those who are interested in what the difference is between a domain local and a global group (something that confused me for a long time) I’ll cover that off in the next blog post.

It’s a very simple process, but is often ignored.  I urge administrators of security anywhere to follow this!

Cheers

Adam