Active Directory Group Scopes (MCP Series)
Local Groups
Local Groups are used to assign premissions to resources on a local computer. Members can be added from any other trusted location including the local domain and any other trusted domains or forests.
Domain Local Groups
Domain Local Groups are used to assign permission to resources in the local domain. Members can be added from any other trusted location. Domain Local Groups are often used to assign permissions.
Domain Local groups can be converted into a Universal Group provided no other Domain Local groups are a member of this Domain Local Group.
Global Groups
Global Groups are used to assign permissions to resources in any domain within the forest. Members can be added from the same domain as the parent Global Group or from the domain of which the group is a member if it has no parent Global Group.
Global Groups can be converted into Universal Groups provided it is not a member of any other Global Group.
Universal Groups
Universal Groups are used to assign permissions to any resource in any domain or forest. Universal Groups can contain members from any domain within the forest and can also include Global Groups from the same domain as the Universal Group resides.
Universal Groups can be converted into Domain Local groups. Universal Groups can also be converted into Global Groups provided no other Universal Groups exist as members of this group.
Local Groups are used to assign premissions to resources on a local computer. Members can be added from any other trusted location including the local domain and any other trusted domains or forests.
Domain Local Groups
Domain Local Groups are used to assign permission to resources in the local domain. Members can be added from any other trusted location. Domain Local Groups are often used to assign permissions.
Domain Local groups can be converted into a Universal Group provided no other Domain Local groups are a member of this Domain Local Group.
Global Groups
Global Groups are used to assign permissions to resources in any domain within the forest. Members can be added from the same domain as the parent Global Group or from the domain of which the group is a member if it has no parent Global Group.
Global Groups can be converted into Universal Groups provided it is not a member of any other Global Group.
Universal Groups
Universal Groups are used to assign permissions to any resource in any domain or forest. Universal Groups can contain members from any domain within the forest and can also include Global Groups from the same domain as the Universal Group resides.
Universal Groups can be converted into Domain Local groups. Universal Groups can also be converted into Global Groups provided no other Universal Groups exist as members of this group.