I'm playing with permissions and noticed the following situation I don't understand.
The PC PC-EXAMPLE is a part of a domain, let's say DOMAIN (domain.com) and the currently logged on user is User-Hello ([email protected]). This user is a member of domain.com/Group-Demo group — Security Group, Universal.
When the full control permissions are set on a partition for and only for:
- SYSTEM
- User-Hello ([email protected])
- Administrators (PC-EXAMPLE\Administrators)
then User-Hello user can access the partition.
When full control permissions are set for:
- SYSTEM
- Group-Demo (DOMAIN\Group-Demo)
- Administrators (PC-EXAMPLE\Administrators)
then the partition is not available any longer for the user User-Hello.
As I understand it, groups, in Active Directory, are intended to simplify, among others, the management of permissions on files and folders, i.e., instead of specifying that a specific directory can be accessed by user 1 and user 5 and user 7 and user 19, etc., one can simply create a group and set the permission for this group.
It appears that it's not the case. So what are groups for? How to set permissions for a set of users without setting those permissions for every user?