Windows 2000 Administration in a Nutshell

Name

local group

Synopsis

A collection of local user accounts.

Description

Local groups allow local user accounts to be grouped together for administrative purposes. Local groups are created in the same local security database where local user accounts are created on a machine. Local groups are created within the Groups folder of the Local Users and Groups console (see Chapter 5).

Since use of local user accounts is usually confined to standalone servers running Windows 2000 Server or client computers running Windows 2000 Professional, local groups are rarely used in Windows 2000-based networks. One possible use of local groups is for several users to share a single standalone server or client computer, and you can then secure files and folders located on that machine. In this case you can create local groups to group local user accounts together in order to manage permissions more easily. Another use is for you to implement a Windows 2000 network using a workgroup model where each machine manages its own security settings.

Here are the membership rules concerning local groups:

• Local groups can contain:

  • Local user accounts from the computer on which the group resides

  • Global or universal groups from any domain

• Local groups cannot be members of other groups.

One confusing difference between Windows 2000 and Windows NT is in the use of local groups. On Windows NT, local groups:

• Are used for assigning permissions to resources in the domain

• Can contain user accounts and global groups from the ...