>>>As an aside, I dislike the use of the word distribution groups and security groups because both could be used for either. Any group can be a distribution group, the groups are simply NT security enabled or not NT security enabled.
Which is why you need to distinguish between them. "Non-NT Security Enabled Group" does not sound as logical as "Distribution Group", especially since the primary use of such groups is distributing emails. In the same vein, "NT Security Enabled Group" is less sexy than simply saying "Security Group", again since the primary use of such group is in the security/permissioning/delegation space, although it could serve the "distributing" purposes too, as you mentioned. I take "both could be used for either" to actually mean "both could be used for DISTRIBUTION" since they are both technically not equally interchangeable, as you clarified in your email. Sincerely, Dèjì Akómöláfé, MCSE+M MCSA+M MCP+I Microsoft MVP - Directory Services www.readymaids.com - we know IT www.akomolafe.com Do you now realize that Today is the Tomorrow you were worried about Yesterday? -anon ________________________________ From: [EMAIL PROTECTED] on behalf of joe Sent: Thu 9/22/2005 10:22 PM To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] When you change group scopes by using a combination of the Dsquery command <G> That is why ADMOD doesn't currently support a group scope type of switch along with other bitwise type ops (such as disable, etc). There are difficulties as you will see below. I expect the fix for this is probably pretty inefficient and could be quite slow if updating a lot of objects, my guess is that it does a lookup on every object prior to updating it to get the current value, no other way to really do it, this means two calls for every update. A more efficient way would be to create a query that picks out the NT security enabled groups and changes their scope and then do it again for non NT security enabled groups. Of course you would have to use the older un-fixed version of dsmod or use admod. As an aside, I dislike the use of the word distribution groups and security groups because both could be used for either. Any group can be a distribution group, the groups are simply NT security enabled or not NT security enabled. joe -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP] Sent: Thursday, September 22, 2005 8:36 PM To: ActiveDir@mail.activedir.org Subject: [ActiveDir] When you change group scopes by using a combination of the Dsquery command When you change group scopes by using a combination of the Dsquery command the Dsmod command, all the group types are changed to either distribution groups or security groups on a Windows Server 2003-based computer: http://support.microsoft.com/?kbid=898063 -- Letting your vendors set your risk analysis these days? http://www.threatcode.com List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
