Organizing Users with Groups

It's also possible to create additional groups to meet specific needs. This is rarely done on local Windows 7 systems alone, but it's often done in a domain to organize users and easily grant specific rights and permissions.

As an example, consider Figure below. Jasmin, Martin, and Sarah are all in the Sales department. A group named G_Sales is created to organize the users, and each user account is then placed in the G_Sales group. Now imagine that the users in the group need access to the SalesData Share hosted on FS1.

Instead of granting the same permissions to the individual accounts, the permissions to the SalesData Share are granted to the group. Because the users are members of the group, they have the same permissions as the group.

While it takes a little planning initially to design and create the groups, it eases the administration burden in the long run. For example, imagine that you originally granted Read permission to a share, but later wanted to change this to Modify for all the users in the Sales department. If a group is created and permissions are assigned to the group, you make the change once and you're done. However, if you originally assigned the permissions to each user, you'd have to modify the permissions for each user.

Groups are also useful even if only one user is a member. For example, imagine that an HR department has only one employee, Maria. On the surface, it may seem easier to assign all the permissions to Maria's account. However, what do you do if Maria is transferred or promoted within the company and someone else needs to take over?

If the permissions are assigned to the individual user, then they all have to be modified to remove Maria's access and grant the new employee's access. However, if a group was created and all the permissions were assigned to the group, you'd simply need to add the new employee's account to the group and remove Maria's account.