Windows Server® 2012 Unleashed

Group Scopes in Active Directory

To complicate the group design a bit more, after the type of group is determined, the scope of the group must also be chosen. The scope, simply put, defines the boundaries of who can be a member of the group and where the group can be used. While scoping does apply to both group types, because only security groups can be used to delegate control or grant resource access, scoping issues typically impact security groups and therefore they are the focus on the remainder of this section.

Domain Local Groups

Domain local groups can be used to assign permissions to perform domain-based administrative tasks and to access resources hosted on domain members. These groups can contain members from any domain in the forest ...