Well... in the old NT4 realm, AGLP (Account goes into Global group which goes into the Local group which gets the Permission) it makes sense, but with AD there is now Domain Local which frankly confuses me too. 
_________________________
Give a man a fish and he will be back for more. Slap him with a fish and he will go away forever.
