|
Posted by Roger Abell [MVP] on April 20, 2006, 10:25 am
Please log in for more thread options
>I have looked into this before due to seeing conficting information from
>different sources. I had also posted the question to one of the MS
>newsgroups here (can't find it right now though) and got a great answer.
>Now I have come across what I think is an incorrect statement and would
>like to verify this here.
>
> The bottom line from the great reply I had gotten previously on this issue
> is that the 'domain' Backup Operators groups is NOT really a 'domain
> local' group. It is a 'built in' group which means it does NOT have domain
> affinity. This means the SID of the group does not contain the portion
> that relates it to a domain. Therefore it can only be used on the 'local'
> machine. In the case of a domain controller, each one shares the same
> account database (active directory) and so the Backup Operators group from
> active directory only has backup/restore rights on *domain controllers*,
> not all member servers (which is what I see stated some places as I will
> show below).
>
> so when you see 'domain Backup Operators' this is not a group with
> privilage over the whole domain. A better name would be 'DC Backup
> Operators'.
>
> the following statement is from a Measure Up practice exam explanation:
> "The Backup Operators group in Active Directory is a domain local group.
> If you add Joanne as a member of the domain Backup Operators group, she
> will have backup and restore rights on all member servers in the domain."
>
> this statement IS incorrect right?
>
not in the default condition of a newly added member server
| 
XML Sitemap