How do I provide permission to access a specific directory in Active directory?

The following section outlines the steps to enable permissions to create and delete computer objects, permissions on these objects, and permissions to change and reset user credentials. These permissions are the minimum level of permissions required for a service account when installing the Connector.

Organisational Unit [OU] Permissions Dialog

Permissions are being assigned to the service account through the OU permissions dialog.

Permissions to Create and Delete Computer Objects¶

The following section outlines how to add permissions to create and delete computer objects through the OU permissions dialog:

  1. Go to the security tab of the OU you want to give permissions to.
  2. Right-click the relevant OU and click Properties.
  3. Go to the security tab and click Advanced.
  4. Click Add and browse to your user account. As stated above you need to add the user account to the OU.
  5. Select This object and all descendant objects and select the following permissions:
    • Create Computer Objects
    • Delete Computer Objects
  6. Click OK.

Permissions on the Computer Objects¶

The following section outlines how to select permissions on the computer objects through the OU permissions dialog:

  1. Go to the security tab of the OU you want to give permissions to.
  2. Right-click the relevant OU and click Properties.
  3. Go to the security tab and click Advanced.
  4. Click Add and browse to your user account. As stated above you need to add the user account to the OU.
  5. Limit the Apply Onto scope to Descendant Computer objects and select the following settings:
    • Read All Properties
    • Write All Properties
    • Read Permissions
    • Modify Permissions
    • Validated write to DNS host name
    • Validated write to service principal name
  6. Click OK.

Hi all,

Im sure this is a simple one, but its vexxing me now!

We have some network shares that only a certain select few want access to which would normally be a simple, remove inherit permissions and setup them locally on the folder and let that propagate throught that folder tree ( and yes it works ).

However they now want this spread across multiple folders, not following any directory tree so i cant just let the permissions inherit from the upper layers.

So my question, can you create a "security group" within AD, add the users to that group, apply that group to the folders, rather than add an ever increasing number of users to many different files for access and for that to work?

Thanks in advance

check Best Answer

  • Indeed you can do exactly that.  Open AD Users and Computers, create a new Security group, open it up and add in the users you want to have access to the folder.  Then in the security rights on the folder and/or the share, do exactly as you would to add in a user, only instead of the username put in the groupname (you will see at the top of the security rights box when you are typing in the user/group name it will say "Users or Groups").

    I have noticed that SOMETIMES (not very often), it may take a few minutes before it will take effect, I think usually if that person has attempted to access the folder recently and the client/server have the old rights cached.

    1 found this helpful thumb_up thumb_down

  • View Best Answer in replies below

    Read these next...

    • How do I provide permission to access a specific directory in Active directory?

      What should I expect with data and camera traffic on the same unmanaged network?

      Networking

      Hey there,I've got to straighten out a network with both 10.x.x.x data clients and cameras + dvrs on a 192.x.x.x both pumping through the same unmanaged switches.  They were separate physical networks at one time, but the two networks have been crossed......

    • How do I provide permission to access a specific directory in Active directory?

      How to record in person trainning

      IT & Tech Careers

      Hi. We're in the process of implementing a new accounting system in our business.  As part of this process there's some in person training provided by the system reseller. this person provide this  training in house in our conference room using his laptop...

    • How do I provide permission to access a specific directory in Active directory?

      Spark! Pro series - 8th December 2022

      Spiceworks Originals

      Today in History: 1980 John Lennon is Shot John Lennon, a former member of the Beatles, the rock group that transformed popular music in the 1960s, is shot and killed by an obsessed fan in New York City. The 40-year-old artist was entering his luxu...

    • How do I provide permission to access a specific directory in Active directory?

      Windows task fires on event, but not when I make the task via GPO

      Windows

      Hello, I made a task on my computer (as a normal user) to fire when it sees an event, which triggers it to show a notification above the systray. It works well enough, but when I made a GPO to create the same task, it does not capture the event. Keep in m...

    • How do I provide permission to access a specific directory in Active directory?

      How to make a headless server have a GUI again?

      Windows

      Hello,We have an old externally-facing WSUS Server (don't ask me why, it was made before I worked here) that I would like to rebuild. The only problem is, it's headless, only comes up with a CLI instead of a GUI. The server is running 2012 R2 and has been...

    What are the three types of access permissions for a file or directory?

    There are three permission types: read, write, and execute.

    What methods can you use to configure permissions on an object in Active Directory?

    They can be accessed by clicking on Advanced in the Security tab and then clicking Edit. The tab will then show you a list of all the permissions given to the object, and you can modify them. You can either allow or deny these permissions using the check box.