Skip to main content

What is the difference between Domain Users and Authenticated User?

By
This question came about from my recommendation that resources are shared utilizing the Authenticate Users group instead of the Everyone group. The issue was why we do not use the Domain Users group. Reading below you will see that the Domain Users group can be used on domain controllers. For resources on non-domain controllers, you will need to use the Authenticated Users group. For simplicity and a consistent configuration throughout your network, I still recommend the use of Authenticated Users for all resource sharing that is open to all authenticate users of your environments.

Microsoft definition of the Authenticated Users group is: Includes all users with a valid user account on the computer or in Active Directory services. Use the Authenticated Users group instead of the Everyone group to prevent anonymous access to a resource.

Domain Users group: This group contains all domain users. By default, any user account created in the domain becomes a member of this group automatically. This group can be used to represent all users in the domain. For example, if you want all domain users to have access to a printer, you can assign permissions for the printer to this group (or add the Domain Users group to a local group, on the print server, that has permissions for the printer).

Everyone Group: Includes all users who access the computer. Windows 2000 will authenticate a user who does not have a valid user account as Guest. The user automatically gets all rights and permissions assigned to the Everyone group. A group that includes all users, even anonymous users and guests. (The anonymous users were removed from this group with Windows Server 2003)  I updated this information on Aug 27, 2012 in another blog posting.

Do not assign resource permissions or user rights to this account. Use Authenticated Users or specific user accounts and groups where necessary
Labels:

Comments

Anonymous said…
You are wrong about the use of the Domain Users group. The group only exists when you have a Domain Controller, and by extension it is hosted there, but you can use it on any member computer (workstation or server). It is the most secure option because (1) its membership is controlled by Administrators and not calculated and (2) because it is a Global Group will only contain users from the local domain. Authenticated Users includes all user and computer accounts from the local domain and any trusted domains.
December 7, 2012 at 1:31 PM
Jason Yoder, MCT said…
Mr. Anonymous, you are correct. Looking at that I’m wondering what I was thinking when I wrote that. I must of have been having a real long day. I have update the information. Please remember to utilize your real name when posting comments.
December 7, 2012 at 6:48 PM
Post a Comment

Popular posts from this blog

Sticky Key problem between Windows Server 2012 and LogMeIn

By
This week I instructed my first class using Windows Server 2012 accessed via LogMeIn and discovered a Sticky Key problem every time you press the Shift key. Here is my solution to resolve this.  First off, in the Preferences of LogMeIn for the connection to the Windows Server, click General . Change the Keyboard and mouse priority to Host side user and click Apply at the bottom. On the Windows 2012 server, open the Control Panel – Ease of Access – Change how your keyboard works . Uncheck Turn on Sticky Keys . Click Set up Sticky Keys . Uncheck Turn on Sticky Keys when SHIFT is pressed five times . Click OK twice. If you are using Windows Server 2012 as a Hyper-V host, you will need to redo the Easy of Use settings on each guest operating system in order to avoid the Sticky Key Problem. Updated Information: March 20, 2013 If you continue to have problems, Uncheck Turn on Filter Keys .
6 comments
Read more

Where did a User’s Account Get Locked Out?

By
Updated: May 15, 2015 When this article was originally published, two extra carriage returns were add causing the code to malfunction.  The code below is correct.   My client for this week’s PowerShell class had a really interesting question. They needed to know where an account is being locked out at. OK, interesting. Apparently users hop around clients and forget to log off, leading to eventual lock out of their accounts. The accounts can be unlocked, but are then relocked after Active Directory replication. This problem is solved in two parts. The first one is to modify the event auditing on the network. The second part is resolved with PowerShell. The first part involves creating a group policy that will encompass your Domain Controllers. In this GPO, make these changes. Expand Computer Configuration \ Policies \ Windows Settings \ Security Settings \ Advanced Audit Policy Configuration \ Audit Policies \ Account Management Double click User Account Management C...
18 comments
Read more

How to run GPResult on a remote client with PowerShell

By
In the past, to run the GPResult command, you would need to either physically visit this client, have the user do it, or use and RDP connection.  In all cases, this will disrupt the user.  First, you need PowerShell remoting enabled on the target machine.  You can do this via Group Policy . Open PowerShell and type this command. Invoke-Command –ScriptBlock {GPResult /r} –ComputerName <ComputerName> Replace <ComputerName> with the name of the target.  Remember, the target needs to be online and accessible to you.
Post a Comment
Read more