AD Groups

Hello, this is Lars. IT Engineer. Certified (and enthusiastic) webmaster. Also an enthusiastic Windows, Apple, and Office user. I write about all kinds of topics around IT. Living in Switzerland. You can find out more about me here: About me. Thanks for your visit!

Group Scope

Domain local

Domain local groups are used to assign permissions to resources.

  • Open Membership
    Members from every group can be added
  • Access to resources in a domain
    In a domain local domain group permissions can be set to a resource that is
    located in the same domain as the local group


Global groups are typically used to organize users.

  • Only people from the same domain can be included in the group
  • Access to resources in all domains
    In a global group permissions can be assigned to a resource located in any


Universal groups are used primarily to assign permissions to resources in
multiple domains.

Universal Group:

  • Open Membership
    Members from any domains can be added
  • Access to resources in all domains
    Permissions can be assigned to a resource located in any domain with
    universal group.

Group type


  • Security groups allow access to the Active Directory objects and
    directories. The membership of these groups will be checked at login.


  • Gives access to distribution lists (email distribution). Distribution
    groups can not used to set security rights.

Changing Group Scope

  • Global to universal
  • Domain local to universal
  • Universal to global
  • Universal to domain local

More Information,v=ws.10).aspx


Did you like the article? Then I'm happy if you like and share it.
Thank you!

Leave a Reply

Your email address will not be published. Required fields are marked *