Domain Local Group: Use this scope to grant permissions to domain
resources that are located in the same domain in which you created the domain
local group. Domain local groups can exist in all mixed, native and interim
functional level of domains and forests. Domain local group memberships are not
limited as you can add members as user accounts, universal and global groups
from any domain. Just to remember, nesting cannot be done in domain local
group. A domain local group will not be a member of another Domain Local or any
other groups in the same domain.
Global Group: Users with similar function can be grouped under global
scope and can be given permission to access a resource (like a printer or
shared folder and files) available in local or another domain in same forest.
To say in simple words, Global groups can be use to grant permissions to gain access
to resources which are located in any domain but in a single forest as their
memberships are limited. User accounts and global groups can be added only from
the domain in which global group is created. Nesting is possible in Global
groups within other groups as you can add a global group into another global
group from any domain. Finally to provide permission to domain specific
resources (like printers and published folder), they can be members of a Domain
Local group. Global groups exist in all mixed, native and interim functional
level of domains and forests.
Universal Group Scope: These groups are precisely used for email distribution and
can be granted access to resources in all trusted domain as these groups can
only be used as a security principal (security group type) in a windows 2000
native or windows server 2003 domain functional level domain. Universal group
memberships are not limited like global groups. All domain user accounts and
groups can be a member of universal group. Universal groups can be nested under
a global or Domain Local group in any domain.
0 Comments