Friday, September 28, 2012

Active Directory Group Scope - Local Domain, Global Group, Universal Group

Domain Local-

You can add members from any domain in your forest but you can give them access to the resources which are available only in  the domain where you create this DL.

Global- 

You can add members only from the domain where you create this DL, and this DL can be given acess to any resources in any other domains in the forest.
For ex, you have Domain A and B. Your users in domain A , need to access a resource in Domain B. How to accomplish this?
From your domain A ,create a Global DL--- create a Domain Local DL in domain B. Add the Domain 'A's Global DL as a member to the Domain B's Domain Local Group.. Give access to the resource in Domain B. It's done..


Universal- 

Add members from any domain, access resources in any domain of the forest.

Hope it helps.. :)