Protect Your Windows Network: From Perimeter to Data

We discuss security groups a lot in this chapter, so just to be sure there is no confusion, we review them here. Security groups are classified according to scope the extent that a group applies in the domain or forest. There are four types: local, domain local, global, and universal. Some important points to remember:

• Members of universal groups can include other groups and accounts from any domain in the domain tree or forest and can be assigned permissions in any domain in the domain tree or forest.

• Members of global groups can include other groups and accounts only from the domain in which the group is defined and can be assigned permissions in any domain in the forest.

• Members of domain local groups can include other groups and accounts from Windows Server 2003, Windows 2000, or Windows NT domains and can be assigned permissions only within a domain.

• Members of local groups can include local accounts, domain accounts, and domain local groups and can be assigned permissions on local resources.

For a detailed discussion of groups, see http://www.microsoft.com/resources/documentation/WindowsServ/2003/all/deployguide/en-us/dsscd_grp_gdjg.asp .