the question is: there are two user domains, A and B, connecting to a
domain controller DC and there is a SQL server which I would like to
allow users in domainB to have global access. Right now, domainA users
have a global group to connect to this server. I know that I could
make another global group for domainB them to connect to this server,
but I need to understand the optimal way to set up the AD for this
particular resource (because it is optimal now to make another global
group, but what if I have domains AA to ZZ?)

---

Clarification of Question by dremcg21-ga on 19 Sep 2004 19:12 PDT

The domains are in the same forest and it is mixed-mode.

Are both domains in the same active directory forest? Seperate
Forests? NT4 and AD domain? You have trusts?

The appropriate way to accomplish this is as follows:

1. In domain A, create a Global Group and add the users from domain A
that require access to the SQL server.
2. In domain B, create a Global Group and add the users from domain B
that require access to the SQL server.
3. In the domain that the SQL server is a member, create a Domain
Local Group. Make the Global Groups from domains A & B members of this
new Domain Local Group.
4. Assign permissions to the SQL server to the Domain Local Group.
5. When new domains appear in your forest, simply create a Global
Group in them representing the users in that domain that require
access, and add this new Global Group to the Domain Local Group in the
domain where the SQL server lives.

This approach is in conformance with Microsoft's "UGLR" approach to
cross-domain group membership (UGLR refers to the fact that "Users"
are assigned to "Global Groups" which are added to "Local Groups"
which are given privileges to the "Resources"). There's some good
additional background on this approach at the following link:
http://www.microsoft.com/technet/prodtechnol/windows2000serv/technologies/activedirectory/maintain/adusers.mspx

(search the page for the bullet "Medium to large organizations")

As an aside, if/when you go to Active Directory Native Mode, this will
be a lot easier because you will only need to have a single Universal
Group to contain users throughout the forest.