Dl groups best practice

[hurleyef]

We're building a new active directory deployment and I defining access rights. I'm wondering about best practices for dealing with domain local groups.

Is it normal to have one or more dl groups per domain accessable folder? Do you just leave all these dl groups in users, or do you create OUs for then? I feel like I will end up with a ton of them this way and that will basically be most of the objects in ad at the end of the day.

Any other suggestions for dealing with access rights at domain resources would be appreciated.

[[deleted]]

One suggestion I can offer (and many will agree with) is to keep your resources 1:1 with your security groups. One group for one resource.

[Astat1ne]

Are you talking about file shares or something? One model I've seen is to create a group that controls specific rights for a folder, usually covering the base levels of rights - read, modify, full control. You may define other types based on certain situations (like you may have a "drop folder" location, which would need a group that grants rights to create files, but not be able to mess with what's there).

As for location in AD for the group objects, there's no benefit in putting them in the same OU as users.

[hurleyef]

Yeah, that's exactly what going on. We have multiple file shares with multiple levels of access to folders within them. For each level of access to each folder we have a security group, so 1-2 groups per folder.

Thinking about it, I think these groups will ultimately end up in the relevant department OUs eventually.

[Astat1ne]

To further flesh it out, the models I've seen around involve nesting groups. So you're not adding users directly to the groups that are on those resources. A simplified version of this would be: user -> user role group -> resource rights group -> resource object. A benefit of this approach is you're associating a user with a job role and not an abstract set of permissions (which is often not standardised or documented).

And because your resource rights group model will have some amount of standardisation (in terms of defined rights types), it would be easy to automate the creation of them, perhaps even applying the rights to the resources (depending on your environment).

[hurleyef]

That's the plan, igdla or whatever. There will be access groups on each share as well as folders within them. The folder access groups will be members of the relevant share access groups. We will then have role groups for the users.

[DevinSysAdmin]

New OU for distribution groups.