Quote:

---

Recently, there have been a few posts with people asking how to convert groups from one type to another. In my experience, I have used nothing but Global groups, and it got me to thinking... "am I missing something?"

The differences between Global and Universal seem obvious enough. However, the differences between Domain Local and Global are not so clear. Between a Exam Cram book, a MS Training kit, and a Tech Net article, I still have no idea why anyone would use a Domain Local Group.

Anyone care to elaborate why/how you use this type of group? Examples would be appreciated.

---

Quote:

---

One advantage of using domain local groups as resource groups is that domain local groups can be managed anywhere in the domain. Creating local groups requires the resource manager to access the specific computer where the local group is to be created. Another advantage of using domain local groups as resource groups is that domain local groups are visible in Active Directory. Assuming that the domain local group is named in a meaningful way, it is relatively easy to locate the resource group and modify it to add or remove account groups.

However, there are also significant disadvantages to using domain local groups as resource groups. For example, suppose Bob is managing a file server with 500 shares, each of which has three resource groups to define the three common access levels. If Bob uses domain local groups for the resource groups, 1,500 groups will be displayed in Active Directory Users and Groups in the Microsoft Management Console (MMC). Furthermore, suppose that Bob has 50 file servers. Even with a meaningful group naming policy, it is not going to be easy to find the right resource group among 75,000 group names. In this case, Bob is much more likely to choose local groups as resource groups

---

Isn't what they are calling Domain Local Groups, Global Groups?

Quote:

---

Domain Local groups function as a local group on the domain controller while the domain is in mixed functional level.

---

Quote:

---

Have domainwide scope in Windows 2000 native and WIndows Server 2003 domain functional level domains, and can be used to grant resource permission on any Windows Server 2003 computer within, but not beyond, the domain in which the group exists.

---

Clear as mud yet?

Quote:

---

Bryce... You may be correct but I can't be sure...

From "Windows Server 2003 Environment Training Kit":

Quote:

---

Domain Local groups function as a local group on the domain controller while the domain is in mixed functional level.

---

But then it goes on to say:

Quote:

---

Have domainwide scope in Windows 2000 native and WIndows Server 2003 domain functional level domains, and can be used to grant resource permission on any Windows Server 2003 computer within, but not beyond, the domain in which the group exists.

---

Clear as mud yet?

---