Re: Domain Local Security vs Global Security vs Universal Security Groups

Nobody knows the answer to this?


Kshaeta wrote:
I've read lots on these, and I still don't really understand them.

I know how they work together, how certain ones can't be part of others, etc. But I don't really understand how they work, or where and when to use them.

Where are DLS (Domain Local Security) groups used, and why?
How about Global Groups? Universal Groups?

Is there any good documentation that explains how these are used and why?

One reason I ask, is say for this problem. I have two security groups, within my domain, and two servers in my domain. One server is a domain server (DOM), the other is a member server (MEM).
I have 2 security groups. The difference between the two is one is a DLS group, the other is a GS group. The DLS one doesn't allow the security group to be set on servers other than the domain servers. That is, if you are on DOM and you create a directory, you can grant it "Information Systems_DLS" security, or "Information Systems_GS" security. But if you log on to MEM, and try that it won't work. You need to grant it "Information Systems_GS". The option to grant any DLS doesn't even show up in the security selection on the member server.

I don't really grasp this. Should "Domain level Security" allow you to grant that security group to any member server?

Thanks for any info.

bil

--
Bill Tkach
MSP, A+
visual{period}eyes{period}this{at}gmail{period}com
.

Relevant Pages

  • Re: Domain Local Security vs Global Security vs Universal Security Groups
    ... I guess my question was "does anyone know why these Domain Local System (DLS) groups behave like this", ... I would assume a DLS group would allow me to use such a group on any server in the domain. ... Seemed weird to me that you would only be able to grant DLS access on the Domain Servers itself. ... I have two security groups, within my domain, and two servers in my domain. ...
    (microsoft.public.windows.server.security)
  • Re: Domain Local Security vs Global Security vs Universal Security Groups
    ... a DLS group would allow me to use such a group on any server in the ... Seemed weird to me that you would only be able to grant DLS access on the ... One server is a domain ... I have 2 security groups. ...
    (microsoft.public.windows.server.security)
  • Re: Domain Local Security vs Global Security vs Universal Security Groups
    ... Where are DLS groups used, ... server, the other is a member server. ... I have 2 security groups. ... You need to grant ...
    (microsoft.public.windows.server.security)
  • Domain Local Security vs Global Security vs Universal Security Groups
    ... I have two security groups, within my domain, and two servers in my domain. ... One server is a domain server, the other is a member server. ... The difference between the two is one is a DLS group, the other is a GS group. ... You need to grant it "Information Systems_GS". ...
    (microsoft.public.windows.server.security)
  • Re: Security Groups issue...
    ... server, the other is a member server. ... I have 2 security groups. ... DLS group, the other is a GS group. ... You need to grant ...
    (microsoft.public.windows.server.active_directory)