We discussed earlier how important it is to assign the correct permissions to an object. Most of the time you should be assigning permission through groups. This keeps you from having to manually assign permissions to every user who needs them. You can assign permissions once to the group, and anybody that you put in that group automatically inherits those permissions. If properly assigning permission to objects is critical to system security, and you should assign permissions through groups, it only makes sense that maintaining group memberships is critical to system security.

Microsoft gives you the GUI tool Active Directory Users and Computers ( Start Programs Administrative Tools Active Directory Users and Computers) to manage domain accounts and the GUI tool Local Users and Groups (located inside of computer management right-click My Computer and choose Manage) to manage local accounts. Sometimes it may be necessary or more convenient to manage groups from the command line. If so, you can use the tools covered in this section to (among other things) show explicit group membership for a user, to show all of the members of a particular group, or to find indirect (inherited) group membership for a user. All three of these tools are installed with the default Windows 2000 Server Resource Kit installation.