Active Directory Administration Cookbook

Group scopes

There are three group scopes, as follows:

• Global groups
• Universal groups
• Domain local groups

When deciding what group to create, you might want to consider that global groups and universal groups can be nested into domain local groups and global groups can be nested into universal groups. Therefore, most organizations have opted to create global groups for departments, universal groups for distribution groups, groups that overarch Active Directory trusts, and domain local groups for access rights.

This way, the user accounts for people in a finance department can be made members of the finance global group. Then, this group can be nested into several domain local groups that provide read, modify, or full control of the finance ...