In AD groups can have several types and scopes (Group Types and Group Scopes).
Group Types
|
Group type |
Description |
| Distribution group
(Distribution group) |
Distribution groups can be used only for email distribution lists. They cannot be used to apply Group Policy settings. They have no security function and are not included in the user's list of security group memberships (security token) at logon. |
| Security group (Security group) | Security groups combine users, computers and other groups into manageable units. When assigning access rights to resources such as shared folders, files or printers, administrators should assign rights to groups rather than individual users. Each security group has its own SID, included in the user's security group membership list (security token) at logon. |
Group Scopes
|
Group scope
|
Description
|
|
Global groups
(Global groups)
|
Global-scope groups can have members (users or groups) only from the domain in which they are defined, but can be assigned access rights anywhere in the forest. |
|
Universal groups
(Universal groups)
|
Global-scope groups can have members (users or groups) from any domain in a Windows 2000/2003/2008 domain tree or forest, and can be assigned access rights in any forest. A universal group is replicated to all GCs in the domain tree. |
|
Domain local groups
(Domain local groups)
|
Domain local groups can have members (users or groups) from Windows NT/2000/2003/2008 domains and can be assigned permissions only within their own domain. |
Komentáře