What does Microsoft recommend for assigning permissions to a set of users?

What does Microsoft recommend for assigning permissions to a set of users?

• A. Create a local group and assign permissions individually
• B. Create a domain local group and assign users directly
• C. Create a global group and then a domain local group for permissions
• D. Create a universal group to manage permissions

Answer: (C)

Creating a global group and then a domain local group for permissions is the recommended approach by Microsoft for assigning permissions to a set of users. This method efficiently manages user rights and access control across different resources while adhering to best practices in group management. Global groups are designed to contain user accounts from the same domain. When you create a global group, you can add users who need similar access to resources. This makes it easier to manage permissions because the group can represent a department or a role within the organization, simplifying the process of adding or removing users as their roles change. Once you have a global group assembled, creating a domain local group allows you to assign permissions to resources within a specific domain. Domain local groups can include users from any domain within the forest, but the main advantage comes from their ability to provide access to resources such as files, shares, or network printers specific to that domain. By using this two-tiered approach, you can efficiently manage and delegate permissions without overcomplicating the solution, which aligns with security and administrative best practices. This method provides a clear structure that enhances both security and ease of management.

Creating a global group and then a domain local group for permissions is the recommended approach by Microsoft for assigning permissions to a set of users. This method efficiently manages user rights and access control across different resources while adhering to best practices in group management.

Global groups are designed to contain user accounts from the same domain. When you create a global group, you can add users who need similar access to resources. This makes it easier to manage permissions because the group can represent a department or a role within the organization, simplifying the process of adding or removing users as their roles change.

Once you have a global group assembled, creating a domain local group allows you to assign permissions to resources within a specific domain. Domain local groups can include users from any domain within the forest, but the main advantage comes from their ability to provide access to resources such as files, shares, or network printers specific to that domain.

By using this two-tiered approach, you can efficiently manage and delegate permissions without overcomplicating the solution, which aligns with security and administrative best practices. This method provides a clear structure that enhances both security and ease of management.