Mastering Active Directory - Second Edition

Groups

In general, a group is a collection of individuals or resources that share the same characteristics and responsibilities. In an organization, individual identities get added and deleted, but roles and responsibilities do not change much. Therefore, the best way to manage privileges in organizations is based on roles and responsibilities rather than individuals. For example, in a sales department, salespersons will change quite often but their operational requirements will not change frequently. They all will access the same file shares, have the same permissions to the customer relationship management (CRM) application, and have the same privileges to access each other's calendars. AD groups allow you to isolate identities based on ...