Home / server / Questions / 164379
Accepted
atricapilla
Asked: 2010-07-28 01:40:58 +0800 CST

AD: What is the difference between local, global and universal groups?

  • 772

What is the basic difference between local, global and universal groups in Active Directory? What is the best practice when assigning users and groups to these groups?

group-policy active-directory

2 Answers

  1. The difference boils down to the scope of the where the permissions are being assigned and whether members of different domains can be added as members of the group.

    • Domain Local

      • Permissions can be assigned only in the local domain.
      • Members can be from any domain in the forest.
      • Intended for use on objects not directly in AD such as file shares, printer queues, etc.
      • Should not be used to assign permissions on AD objects (e.g. OU's, User accounts, etc.) because they cannot be evaluated in other domains.

    • Global

      • Permissions can be assigned in any domain.
      • Members must be in the same domain as the group.

    • Universal

      • Permissions can be assigned to anywhere in the forest.
      • Members can be from any domain in the forest.

    Sources:

    • 9
  2. Best Answer

    The difference is which groups/users you can include in the different groups, which permissions can be assigned to that group, and if the group can be converted.

    If you only have one domain and one tree, and you know it will stay that way forever, you really don't need to know a lot about this. But, i strongly encourage you to read this: http://technet.microsoft.com/en-us/library/cc755692%28WS.10%29.aspx

    You will hate the person who set up groups in the first place if you ever have to fix their mistake. I've had to, and it is no fun.

    • 4