|
Hi Al,
Basically without going into a lot of white paper detail.
Usage also depends on if you're in Native Mode or not and if you are multi domain or single domain.
In a multi domain model here is what should work well for you.
Place accounts into Global groups from each domain
Place Global groups into Universal groups and ACL using the Universal group. This then allows users from any of your domains to access data from any of your domains.
The use of Domain Local Groups will work fine in general except that you can not ACL objects on other domains, it can only be used for ACL on the same domain. Thus using Global into Universal and ACL can then be used on any of the domains. DO NOT place user accounts into Universal groups though as that will place a heavy load on your Global Catalog Servers. GCS do not see the changes to accounts within a Global Group that resides in the Universal Group, so traffic is much less then if you actually use accounts in the Universal. Global Groups rarely change so there is no update to the GC until a full replication cycle.
The one exception we have found to MS' recommendations is on mailing list/distribution list groups, which have to be Universal if they will contain members from multiple domains, otherwise not all the recipients will receive the message.
| 
