Global Scope

Tech-Archive recommends: Fix windows errors by optimizing your registry

Hello there. I need someone to explain the differences between Domain
Local, Global and Universal Groups. I pick up concepts very quickly,
but this one just has me at a loss. I have read three separate study
guides and still cannot understand global scope.

The article I am in front of right now reads;

" ... The easier, more accurate and secure way to assign the
permissions needed would be to create a Domain Local group and assign
it the required permissions on the file shares. "

Which I completely understand. Very straight forward, if it ended
there...

" After doing this, the administrator could create a Global group and
place the 20 user accounts into that Global group. Adding the Global
group to the Domain Local group results in all 20 users inheriting the
Domain Local group's assigned permissions ... "

What? Why would you do that? Surely you would simply assign the users
to the Domain Local group, as outlined in the first paragraph. Why does
the Global group even come into play?

I really need some help on this one.

Thanks,

Luke O'Connell
luke.us@xxxxxxxxx

.

Relevant Pages

  • Re: Global Group
    ... global groups to local groups. ... > global groups from each domain to a universal group and assign the> permissions to the universal group. ... Microsoft seem to have changed their> mind about the A-G-DL-P permissions model and don't recommend you assign> permissions directly to a domain local group. ...
    (microsoft.public.win2000.active_directory)
  • RE: ntfs permissions and AD restore password
    ... I seem to be stuck which way to play the changes to the permissions after I ... If I simply change the domain local group to become a universal groups then ... -add the User Accounts to Global Groups ...
    (microsoft.public.windows.server.active_directory)
  • Permissions help
    ... I am experimenting with NTFS permissions at home. ... Windows Server 2003 and Windows XP Pro with SP2 as my client. ... permissions on the printer itself to add the domain local group. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: revoke change permissions?
    ... You can't use the Effective Permissions as the end all of the configuration. ... It sounds like you are correct in setting up Deny to Change Permissions to ... > I have a shared folder on a Windows 2003 server, ... > The domain local group has been given full control minus Change ...
    (microsoft.public.windows.server.security)