Active Directory Design and Security Concepts - MCTS Guide to Microsoft Windows Server 2008 Active Directory Configuration - page 124

10. Click Joe Tech1 in the Sales Properties dialog box, and then click Remove . Because you have
disabled inheritance, you can now remove or edit any permissions that were previously
inherited and couldn't be removed or changed. Click OK .
11. Right-click the Advertising OU and click Properties . Click the Security tab. Click Joe Tech1 ,
and then click Remove . Note that disabling inheritance on the Sales OU doesn't affect the
Advertising OU. Click OK , and then click Cancel .
12. Leave Active Directory Users and Computers open for the next activity.
One challenge an administrator faces when dealing with permissions and permission inher-
itance is determining who has access to which objects. With the Advanced Security Settings
dialog box, you can determine what permissions a user or group has to an object. Click the
Effective Permissions tab, and then select a user or group whose effective permissions you want
to view, as shown in Figure 4-7. You can only view permissions here; you can't change them.

Figure 4-7

The Effective Permissions tab

Activity 4-5: Determining Effective Permissions

Time Required: 15 minutes
Objective: Set up different permissions and then verify the results by checking effective
permissions.
Description: A junior administrator has some questions about how permissions work. You create
an account for her to use and delegate control of a test OU to her so that she can work with
some different permission situations and use the Effective Permissions tab to verify her results.
1. If necessary, log on to your server as Administrator, and open Active Directory Users and
Computers.
2. Create an OU under the domain node named TestOU1 .
3. Create a user under the Operations OU with a logon name of jradmin , full name of Jr Admin ,
and password of Password01 . Make sure the user's password never expires.
4. Right-click TestOU1 and click Delegate Control . Click Next .
5. Click Add to open the Select Users, Computers, or Groups dialog box. Type jradmin , click
OK , and then click Next .