How to Choose nested processing in Windows security groups

If you find that the nested Global Security Group is the culprit when you troubleshoot the failure caused by permission issues. Nested global security groups can cause many problems, especially when the deny permission takes effect. Considering the existence of a large number of deny permissions based on group policies, the entire tracing process may be quite complicated.

Should you allow operations on nested global security groups for the Active Directory domain? At first glance, for most tools, troubleshooting for group members is quite complicated. Many tools have the report power, but if a nested group exists here, it is not necessary, and it is simpler than the situation of group members.

I would like to say that nesting of group members is prohibited, but this method makes sense only by chance. Based on my personal understanding of professional management, we recommend that you use the following guidelines to restrict group members:

1. Prohibit group members from having more than two levels of nesting.

2. The "members" in a security group cannot have more than two set attributes.

3. A nested Security Group cannot contain a specified group with the denied permission.

4. A nested global security group cannot be a group with high-level permissions.

This is a basic principle, but it does not mean to fully restrict all effective use of nested global security groups. The key to these guidance is the principle of least privilege, which does not increase the burden on the troubleshooting process and reduces the risks caused by excessive distribution of permissions. Limiting the use of nested groups also helps prevent issues related to the size of tokens.

When you need to add a computer account to a global security group, if the user account and the computer account are in the same security group, the situation will become more difficult. In another case, the built-in group comes from the Local Computer System) occurs when combined with the domain user account for separate processing. In these cases, nested operations can effectively process specific configurations like other tools.

1. Windows xp net command for System Security
2. 15 of the best Windows security detection tools