Active Directory Groups

Groups are containers that contain user and computer objects within them as members. When security permissions are set for a group in the Access Control List on a resource, all members of that group receive those permissions. Domain Groups enable centralized administration in a domain. All domain groups are created on a domain controller.

In a domain, Active Directory provides support for different types of groups and group scopes. The group type determines the type of task managed with the group. The group scope determines whether the group can have members from multiple domains or a single domain.

Group Types

• Security groups: Use Security groups to grant permission to gain access to resources. Sending an e-mail message to a group sends the message to all group members. Therefore, security groups share the capabilities of distribution groups.
• Distribution groups: Distribution groups are used for sending e-mail messages to groups of users. Permissions cannot be granted to security groups. Even though security groups have all the capabilities of distribution groups, distribution groups are still required because some applications can only read distribution groups.

Group Scopes

Group scope normally describes the type of users that should be clubbed together in a way that is easy for their administration. Therefore, groups play an important part in domain. One group can be a member of other group(s), which is known as Group nesting. One or more groups can be members of any group in the entire domain(s) within a forest.

• Domain Local Group: Use this scope to grant permissions to domain resources that are located in the same domain in which the domain local group was created. Domain local groups can exist in all mixed, native, and interim functional level of domains and forests. Domain local group memberships are not limited as users can add members as user accounts and universal and global groups from any domain. Nesting cannot be done in a domain local group. A domain local group will not be a member of another Domain Local or any other groups in the same domain.
• Global Group: Users with similar functions can be grouped under global scope and can be given permission to access a resource (like a printer or shared folder and files) available in local or another domain in the same forest. Simply put, global groups can be use to grant permissions to gain access to resources that are located in any domain but in a single forest as their memberships are limited. User accounts and global groups can be added only from the domain in which the global group is created. Nesting is possible in Global groups within other groups as users can add a global group into another global group from any domain.They can be members of a Domain Local group to provide permission to domain specific resources (like printers and published folder). Global groups exist in all mixed, native, and interim functional level of domains and forests.
• Universal Group Scope: these groups are precisely used for email distribution and can be granted access to resources in all trusted domain as these groups can only be used as a security principal (security group type) in a windows 2000 native or windows server 2003 domain functional level domain. Universal group memberships are not limited like global groups. All domain user accounts and groups can be a member of a universal group. Universal groups can be nested under a global or Domain Local group in any domain.

Built-in and Predefined Groups

In addition to built-in groups, domain controllers have default pre-defined groups. When a computer becomes a domain controller, Windows Server 2003 automatically creates these groups in Active Directory Users and Computers.

• Built-in Domain Local Groups: These groups provide users with pre-defined rights and permissions to perform tasks on domain controllers and in active directory.
• Special Identities: These groups, also known as special groups, automatically organize users for system use. Administrators do not assign users to them. Rather, users are either members by default or become members during network activity. Special groups are not visible in active directory users and computers.
• Pre-defined Global Groups: These groups give administrators an easy mode of controlling all users in a domain. Pre-defined global groups are on domain controllers only.