> > > > > I would refrain from everyone and add the user's domain group like > > domain\programmers which closes some security issues. Also this must be > > done in a Computer Start-up script as the user will not have the access > > to add themselves to the group so the computer has to be restarted. > > > > Ah yes, the real solution. Unfortunatly this requires Samba 3 and using > a backend that is not the old ldap passwd backend (ldapsam-compat). You > cannot add users to domain groups (besides the default 'Domain Users' > group) or add domain groups to a local group. > > My question is why a startup script? Your explanation is unclear. As I > don't use domain groups at work, won't a group mapping even if it is > domain -> local remain between reboots?
Unless your users are Admins which I doubt since they can not debug, they will not have sufficient permission to execute the add group command. Using a start-up script runs the script with system privileges. Now with Active Directory which we use, we can set-up OUs to have policies that such and such a person can have rights to a computer depending on where it is placed in the directory tree because it is configured using group policy. As far as the group remaining after reboots, yes it would unless you create a policy that creates exclusive groups which would wipe them out every policy refresh, but they would be re added after a reboot. If someone accidentally removed the group it would also be restored. You can easily add new computers to the OU without having to remember to set-up the group, etc. > Also, as for security problems, what if all your users need to have this > functionality? Then there are no security issues that aren't going to be > present anyways. This is the situation I am in, and it is the only > solution I could find after a week of searching. Yes, I try to take the approach of deny all and then allow who need it, no telling what accounts are set-up with very unsecure passwords who won't need it. Since you are not using groups (Samba issue? Or company decision?) I don't think you have much of a choice. I do believe that members of the debuggers group have certain admin rights. Hope that is more helpful. Robert LeBlanc BioAg Computer Support > -- > Scott Paul Robertson > http://spr.mahonri5.net > GnuPG FingerPrint: 09ab 64b5 edc0 903e 93ce edb9 3bcc f8fb dc5d 7601 -------------------- BYU Unix Users Group http://uug.byu.edu/ The opinions expressed in this message are the responsibility of their author. They are not endorsed by BYU, the BYU CS Department or BYU-UUG. ___________________________________________________________________ List Info: http://uug.byu.edu/cgi-bin/mailman/listinfo/uug-list
