Tag: security group

Microsoft: Active Directory Domain Service Security Group

by Samuel Mitchell, posted in Microsoft, windows, Windows server

Security group scope

1. Universal

  • Forest users accessing its own Forest resources. (FF)
  • It can contain a combination of Global and Domain Local group

E.g. Enterprise Admins, Schema Admins (in the Users container)

2. Global

  • Domain users accessing its own Forest resources. (DF)

E.g. Domain Users, Domain Admins (in the Users container)

3. Domain Local

  • Forest users accessing Domain resources. (FD)
  • This is only group that can have members from an external forest

E.g. Administrators, Account Operators, Backup Operators, Print Operators (in the Builtin container)