This chapter talks about creating and managing security objects such as user, group, and machine accounts. Security objects refer to objects in Active Directory that can be assigned permissions to other objects.

Active Directory is the directory service for Windows Server 2003 (and Windows 2000). It provides a way of storing information so it can easily be retrieved and used later. It functions as a central repository for security objects, which allows for centralized authentication and centralized administration.

User accounts represent people and are used by people to log on to Windows machines. User accounts can also be used as application service accounts. User accounts provide authentication, authorization, and auditing.

Groups are objects that contain other objects such as users, other groups, and machines. Groups simplify management of user accounts by enabling you to apply permissions and user rights to an entire group of users at once instead of having to apply them to individual user accounts.

There are two types of groups (type identifies the purpose of the group):

• Distribution Used for e-mail purposes. An e-mail is sent to the group and all members get a copy.

• Security Used for assigning permissions to resources.

There are three scopes of groups (scope refers to how the group is used):

• Domain Local Includes other groups and user/computer accounts from Windows Server 2003, Windows 2000 Server, and Windows NT domains. Permissions for only the domain in which the group is defined can be assigned to domain local groups.