Windows Server® 2012 Unleashed

Defining AD Groups

The idea of groups has been around in the Microsoft world for much longer than OUs have been. As with the OU concept, groups serve to logically organize users into an easily identifiable structure. However, some major differences exist in the way that groups function as opposed to OUs. Among these differences are the following:

• Group membership is viewable by users—Whereas OU visibility tends to be limited to administrators using special administrative tools, groups can be viewed by all users engaged in domain activities. For example, users who are setting security on a local share can apply permissions to security groups that have been set up on the domain level.

• Membership in multiple groups—OUs are similar to a file ...