Active Directory Nested Security Group

Yes, AD supports group nesting in domains operating in windows 2000 native mode and higher. The limitations are based on the type of group you have.

There are three types:

1. Global
2. Domain Local
3. Universal

Global Groups can only contain accounts and other global groups from the domain the group resides in. They can be used in any domain within the AD forest (or trusted domains).

Domain Local groups can contain global/ Universal groups, computer objects, and accounts from any domain in the Forest (or trusted domains). The can only be used in the domain the group resides in.

Universal Groups can contain global/ Universal groups, computer objects, and accounts from any domain within the AD forest (or trusted domains). They can be used in any domain within the AD forest (or trusted domain).

Global Catalog severs will cache the members of Universal Groups.

Short version: Yes.

Long version: Yes, but...

Nesting can be limited by the scopes of the groups in play; domain local, global, and universal.

• A universal group can be a member of a universal group or a domain local group
• A global group can be a member of any type of group - if it's another global, it must be from the same domain
• A domain local group can be a member only of other domain local groups in the same domain

See here for more info on group scope here.

Additionally, be careful of badly behaved applications - some applications which read group membership from raw ldap based only on the members attribute of the group or the memberOf attribute of the user will miss the nested memberships.

Also, keep in mind that each group that a user is a member of will add to the size of their kerberos ticket if the group's in security mode. With too much nesting, beware of hitting the ticket size limit.

Yes you can. Here are a few helpful articles:

http://technet.microsoft.com/en-us/library/cc783634(WS.10).aspx http://technet.microsoft.com/en-us/library/cc737585(WS.10).aspx

And you can find some scripts enabling to draw/graph nested groups here :

https://gallery.technet.microsoft.com/scriptcenter/Graph-Nested-AD-Security-eaa01644