Re: Nesting Groups Query

From: Steven L Umbach (n9rou_at_nospam-comcast.net)
Date: 06/22/04 

Date: Tue, 22 Jun 2004 17:41:47 GMT

Here is a link that may help. If you only have one domain, then it probably makes
sense to use universal groups sparingly and keep in mind that they require use of the
global catalog server and for Windows 2000 do not put individual users in universal
groups due to the global catalog replication that will occur every time you add
users. As you said, add domain users to domain global groups. Universal groups would
be good for putting global groups into for access to a common resource via nesting in
domain local groups. --- Steve

http://www.computerperformance.co.uk/Litmus/universal_groups.htm

"Tony F" <TonyF@discussions.microsoft.com> wrote in message
news:0A6B7FC6-12B6-4951-AB04-8701B654D164@microsoft.com...
> Hi There,
>
> I Have a quick question regarding Nesting Groups. I currently have 4 sites in my
active directory. We recently upgraded our bandwidth between sites and have begun to
move all user data to a NAS located in the root domain. I have created some groups
and granted them access to certain directories on the NAS. I have also created other
groups with contain users and nested them in to the NAS access groups. My question is
should the groups that give access rights to the NAS be Universal groups or Domain
Local group. Also am i right to assume that groups that contain users should be
Global Groups. Any assistance on this would be gratefully received.
>
> Thanks..

Relevant Pages

  • Re: Adding Groups as members of Groups ???
    ... >> I can add global groups into local groups, but what if I want to create ... > Windows 2000 native mode in your active directory. ... > And you are able to use universal groups as well when you are in native ...
    (microsoft.public.windows.server.active_directory)
  • Re: Child domain cannot send to parent global security group
    ... child domain to have security access to resources, but want them to be part ... The domain local scope can contain user accounts, universal groups, and ... global groups from any domain. ... Global security groups are most often used to organize users who share ...
    (microsoft.public.exchange.admin)
  • Re: Child domain cannot send to parent global security group
    ... You can assign these permissions only in the same ... The domain local scope can contain user accounts, universal groups, and ... global groups from any domain. ... assign permissions for access to resources in any domain. ...
    (microsoft.public.exchange.admin)
  • Re: Child Domain access
    ... Group Scope ... -- Domain Local groups can contain members from ANY domain but can only be ... -- Global groups can only contain members from their OWN domain but can be ... domain and can be a member of domain local or universal groups in any ...
    (microsoft.public.windows.server.active_directory)
  • Re: Adding domain user to local group
    ... What I have is a server that is not a member of ... Pemission NTFS ... Put Accounts in a Global groups of your domain. ... Global groups in a Universal groups in your forest. ...
    (microsoft.public.windows.server.general)