MicrosoftВ® WindowsВ® Command-Line Administrators Pocket Consultant

Group accounts help you manage privileges for multiple users. In Windows Server 2003, there are three types of groups:

• Security groups Groups that have security descriptors associated with them and are used to help manage access permissions. You create and manage security groups with the directory services commands.

• Distribution groups Groups used as e-mail distribution lists, which don’t have security descriptors associated with them. You create and manage distribution groups with the directory services commands.

• Local groups Groups used on the local computer only. You create and manage local groups with the network services commands.

Security and distribution groups are used with domains. This makes them available throughout the directory. Local groups, however, are available only on the computer on which they are created. The general domain group account command-line utilities include

• DSADD GROUP Creates a group account in Active Directory. The syntax is

  dsadd group GroupDN [-secgrp {yes | no}] [-scope {l | g | u}][-samid SAMName] [-desc Description] [-memberof Group ...][-members Member ...] [{-s Server | -d Domain}] [-u UserName] [-p {Password | *}] [-q] [{-uc | -uco | -uci}]

• DSGET GROUP Displays the properties of group accounts using one of two syntaxes. The syntax for viewing the properties of multiple groups is

  dsget group GroupDN ... [-dn] [-samid] [-sid] [-desc] [-secgrp][-scope] [{-s Server | -d Domain}] [-u UserName] [-p {Password | *}] [-c] [-q] [-l] [{-uc | -uco | - uci}] [-part PartitionDN [-qlimit] [-qused]]

  The syntax for viewing the group membership information for an individual group is

  dsget group GroupDN [{-memberof | -members} [-expand]] [{-s Server | -d Domain}] [-u UserName] [-p {Password | *}] [-c] [-q] [-l] [{-uc | -uco | -uci}]

• DSMOD GROUP Modifies attributes of one or more group accounts in the directory. The syntax is

  dsmod group GroupDN ... [-samid SAMName] [-desc Description] [-secgrp {yes | no}] [-scope {l | g | u}] [{-addmbr | -rmmbr |-chmbr} MemberDN ...] [{-s Server | -d Domain}] [-u UserName] [-p {Password | *}] [-c] [-q] [{-uc | -uco | -uci}]

To manage local group accounts, you use the NET LOCALGROUP command. This command has several different syntaxes. The syntax you use depends on what you want to do, as follows:

• Create local group accounts net localgroup [GroupName {/add [/comment:“Text”]}

• Modify local group accounts net localgroup [GroupName Name [ ...]{/add | /delete}]

• Delete local group accounts net localgroup [GroupName {/delete [/comment:“Text”]}