Local
Active Directory Group Scope Local is one of the three group scopes in Active Directory, along with Domain Local and Global. Groups with Local scope are only available within the domain in which they are created and cannot be used to grant permissions or access resources in other domains or forests.
Local groups are typically used for assigning permissions or access to resources on a specific computer or server within the domain. For example, you could create a local group on a file server and assign permissions to that group to control who has access to the shared files and folders on that server.
Here are some usage examples of Active Directory Group Scope Local:
- Assigning permissions to a printer: You can create a local group on a print server and assign the necessary permissions to that group. Then, you can add users or other groups to the local group to grant them access to the printer.
- Managing local administrator access: You can create a local group on a workstation or server and add user accounts or other groups to that group to grant them administrative access to that specific computer.
- Restricting access to a folder: You can create a local group on a file server and assign permissions to that group for a specific folder or file. Then, you can add users or other groups to the local group to grant them access to the folder or file.
Active Directory Group Scope Local provides a simple and efficient way to manage permissions and access to resources within a specific domain.
Domain Local
Active Directory Group Scope Domain Local is one of the three group scopes in Active Directory, along with Global and Local. Groups with Domain Local scope are used to grant permissions or access to resources within the same domain, as well as to other domains or forests.
Domain Local groups are typically used for managing permissions to resources that are shared across multiple domains. For example, you can create a Domain Local group on a file server in one domain and add user accounts or groups from other domains to that group to grant them access to the shared files and folders.
Here are some usage examples of Active Directory Group Scope Domain Local:
- Managing access to shared resources: You can create a Domain Local group on a file server and assign permissions to that group for a specific shared folder or file. Then, you can add users or other groups from any domain to the Domain Local group to grant them access to the shared resource.
- Managing access to an application: You can create a Domain Local group and assign permissions to that group for a specific application. Then, you can add users or groups from any domain to the Domain Local group to grant them access to the application.
- Delegating administrative permissions: You can create a Domain Local group and grant administrative permissions to that group for a specific domain or organizational unit. Then, you can add user accounts or other groups to the Domain Local group to delegate administrative permissions to them.
Active Directory Group Scope Domain Local provides a flexible and powerful way to manage permissions and access to resources across multiple domains or forests.
Gobal
Active Directory Group Scope Global is one of the three group scopes in Active Directory, along with Domain Local and Universal. Groups with Global scope are used to grant permissions or access to resources within the same domain.
Global groups are typically used for managing permissions to resources that are shared within the same domain. For example, you can create a Global group for a specific department or project and add user accounts or groups to that group to grant them access to the shared resources.
Here are some usage examples of Active Directory Group Scope Global:
- Managing access to shared resources: You can create a Global group and assign permissions to that group for a specific shared folder or file. Then, you can add user accounts or other groups to the Global group to grant them access to the shared resource.
- Managing access to an application: You can create a Global group and assign permissions to that group for a specific application. Then, you can add user accounts or other groups to the Global group to grant them access to the application.
- Managing group memberships: You can use Global groups to manage memberships of other groups. For example, you can create a Global group for all employees in a specific department, and then add that Global group as a member of a Domain Local group that has access to shared resources.
Active Directory Group Scope Global provides a simple and effective way to manage permissions and access to resources within the same domain.
Universal
Active Directory Group Scope Universal is one of the three group scopes in Active Directory, along with Global and Domain Local. Universal groups are used to grant permissions or access to resources that span multiple domains within the same forest.
Universal groups are typically used for managing permissions to resources that are shared across multiple domains within the same forest. For example, you can create a Universal group and assign permissions to that group for a specific shared folder or file that is accessible to users in multiple domains.
Here are some usage examples of Active Directory Group Scope Universal:
- Managing access to resources across multiple domains: You can create a Universal group and assign permissions to that group for a specific shared folder or file that is accessible to users in multiple domains.
- Managing group memberships across multiple domains: You can use Universal groups to manage memberships of other groups across multiple domains. For example, you can create a Universal group for all employees in a specific department and add that Universal group as a member of a Domain Local group that has access to shared resources across multiple domains.
- Managing trust relationships: Universal groups can be used to manage trust relationships between domains. For example, you can create a Universal group and add it as a member of the “Allowed RODC Password Replication Group” in the Active Directory forest root domain to enable read-only domain controller (RODC) password replication for the domain.
Active Directory Group Scope Universal provides a powerful way to manage permissions and access to resources across multiple domains within the same forest.
