如何为不同应用程序中的AD组分配特定权限？
这个问题听起来可能有些模糊，但是我不确定该如何说话。我在广告方面几乎没有经验，但是人们总是与您如何应用文件夹权限相似，但这仍然没有为我回答问题。为了将其置于某种情况下，我将如何限制某个小组在SCCM中说明工作站，而另一组仅部署应用程序。或另一个示例是使用Microsoft Visio和另一组具有读写权限的组时仅具有读取权限的组
The question might sound a bit vague, but I wasn't sure how else to word it. I've had little experience with AD but people have always explained it similarly to how you apply folder permissions but that still doesn't answer the question for me. To put it into some context, how would I restrict a certain group to say deploy workstations in SCCM and another to only deploy applications. Or another example would be a group with only Read permissions when using Microsoft Visio and another group with read and write permissions
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
• 每个需要Active Directory 服务的应用程序都必须与AD 集成，即打开与AD 进行入站和出站通信所需的LDAP 和Kerberos 协议端口对于该应用程序。完成后，确保应用程序使用 LDAP 身份验证从公钥基础设施 (PKI) 服务器（在本例中为 Active Directory 服务器）检索授权和验证响应所需的详细信息。
• 然后，当您配置该应用程序的API 访问权限时，请确保选择所需的组和用户来访问该应用程序。例如，如果您希望 AD 环境中的某些组能够访问您的防病毒软件服务器，那么您必须在该应用程序的主服务器或 EPO 服务器中进行相同的配置。因此，正如您所说，在 SCCM 的情况下，如果只想允许某一组用户在 SCCM 中部署工作站，而另一组用户通过它部署应用程序，那么您将在 SCCM 控制台的安全性→管理工作区中创建自定义安全角色其中将创建所需的角色，并相应地为这些 ID 设置有关其需要执行的角色的权限。
• 因此，SCCM 具有内置功能，可根据创建的角色授予与其支持的各种任务相关的特定权限。因此，Active Directory 中不同组的权限取决于那些想要与 AD 集成的应用程序及其身份验证机制。
• Every application that requires the services of Active Directory must integrate with AD, i.e., open the required LDAP and Kerberos protocol ports with respect to inbound and outbound communication to happen with AD for that application. Once done, then ensure that the application uses LDAP authentication for retrieving the details required for authorized and validated response from a Public Key Infrastructure (PKI) server, in this case, Active Directory Server.
• Then, when you configure the access for the API of that application, ensure that the required groups and users are selected for access to that application. Like for example, if you want certain groups of your AD environment to have access to your Anti-virus software server, then you will have to configure the same in that application’s Master server or EPO Server. Thus, as you said, in case of SCCM, if want to allow only a certain group of users to deploy workstations in SCCM and another to deploy applications through it, then you will create a custom security role in Security Administration workspace of SCCM console wherein the required role will be created and accordingly permissions will be set for those IDs regarding the role they need to perform.
• Thus, SCCM has inbuilt functionality to grant specific permissions relating to the various tasks that it supports according to which roles are created. Hence, permissions for different groups in Active Directory depend on those applications which want to integrate with AD and its authentication mechanism.