• Main Menu
  • Active Directory Groups


    Groups are containers that contain user and computer objects within them as members. When security permissions are set for a group in the Access Control List on a resource, all members of that group receive those permissions. Domain Groups enable centralized administration in a domain. All domain groups are created on a domain controller.

    In a domain, Active Directory provides support for different types of groups and group scopes. The group type determines the type of task managed with the group. The group scope determines whether the group can have members from multiple domains or a single domain.

    Group Types

    • Security groups: Use Security groups to grant permission to gain access to resources. Sending an e-mail message to a group sends the message to all group members. Therefore, security groups share the capabilities of distribution groups.Active Directory Groups
    • Distribution groups: Distribution groups are used for sending e-mail messages to groups of users. Permissions cannot be granted to security groups. Even though security groups have all the capabilities of distribution groups, distribution groups are still required because some applications can only read distribution groups.

    Group Scopes

    Group scope normally describes the type of users that should be clubbed together in a way that is easy for their administration. Therefore, groups play an important part in domain. One group can be a member of other group(s), which is known as Group nesting. One or more groups can be members of any group in the entire domain(s) within a forest.

    • Domain Local Group: Use this scope to grant permissions to domain resources that are located in the same domain in which the domain local group was created. Domain local groups can exist in all mixed, native, and interim functional level of domains and forests. Domain local group memberships are not limited as users can add members as user accounts and universal and global groups from any domain. Nesting cannot be done in a domain local group. A domain local group will not be a member of another Domain Local or any other groups in the same domain.
    • Global Group: Users with similar functions can be grouped under global scope and can be given permission to access a resource (like a printer or shared folder and files) available in local or another domain in the same forest. Simply put, global groups can be use to grant permissions to gain access to resources that are located in any domain but in a single forest as their memberships are limited. User accounts and global groups can be added only from the domain in which the global group is created. Nesting is possible in Global groups within other groups as users can add a global group into another global group from any domain.They can be members of a Domain Local group to provide permission to domain specific resources (like printers and published folder). Global groups exist in all mixed, native, and interim functional level of domains and forests.
    • Universal Group Scope: these groups are precisely used for email distribution and can be granted access to resources in all trusted domain as these groups can only be used as a security principal (security group type) in a windows 2000 native or windows server 2003 domain functional level domain. Universal group memberships are not limited like global groups. All domain user accounts and groups can be a member of a universal group. Universal groups can be nested under a global or Domain Local group in any domain.

    Built-in and Predefined Groups

    In addition to built-in groups, domain controllers have default pre-defined groups. When a computer becomes a domain controller, Windows Server 2003 automatically creates these groups in Active Directory Users and Computers.

    • Built-in Domain Local Groups: These groups provide users with pre-defined rights and permissions to perform tasks on domain controllers and in active directory.
    • Special Identities: These groups, also known as special groups, automatically organize users for system use. Administrators do not assign users to them. Rather, users are either members by default or become members during network activity. Special groups are not visible in active directory users and computers.
    • Pre-defined Global Groups: These groups give administrators an easy mode of controlling all users in a domain. Pre-defined global groups are on domain controllers only.

    Leave a Reply to nobody Cancel reply

    Your email address will not be published. Required fields are marked *

    4 comments
    1. nobody

      15 January, 2012 at 10:10 am

      Copied and pasted from the Microsoft’s webpage, well lest say it is helpful. 

      Reply
    2. Muhammed Khan

      28 October, 2011 at 11:46 am

      Very Helpful and pretty understandable…..Good Job Mate

      Reply
    3. Kochumon Nair

      15 October, 2011 at 5:36 am

      Short and sweet, very easy to understand. Thank you for posting this.

      Reply
    4. Jeff B.

      8 August, 2010 at 6:31 pm

      Very good looking up answers for take home exam approved to google by instructor 😛 😛

      Reply
    Microsoft Active Directory
    267 queries in 0.324 seconds.