Mastering Active Directory

Groups

In general, a group is a collection of individuals or resources which share the same characteristics and responsibilities. In an organization, individual identities get added and deleted, but roles and responsibilities do not change much. Therefore, the best way to manage privileges in organizations is based on roles and responsibilities rather than individuals. For example, in a sales department, sales persons will change quite often but their operational requirements will not change frequently. They all will access the same file shares, have the same permissions to CRM application, and have the same privileges to access each other's calendars. AD groups allow you to isolate identities based on the privileges requirements.

In an AD ...