What are AD groups, their type and scopes?
Active Directory (AD) groups are containers that hold user accounts, computer accounts, and other groups within a network.
The purpose of AD groups includes simplifying administration, managing permissions, and organizing users and resources.
Types of AD Groups:
There are 2 types of Active Directory Groups as below:
- Security Groups
- Distribution Groups
- Security Groups: Used to manage access to resources in the domain. You can assign permissions to resources (like files, folders, printers, etc.) based on membership in security groups. Users can be added to or removed from security groups to grant or revoke access to resources.
- Distribution Groups: Primarily used for email distribution. When an email is sent to a distribution group, it's distributed to all members of that group. Distribution groups do not have security identifiers (SIDs) and cannot be used to assign permissions to resources.
Group Scopes:
There are 3 group scopes as follows:
- Domain Local Groups
- Global Groups
- Universal Groups
- Domain Local Groups: Used to assign permissions within a single domain. They can contain user accounts, computer accounts, and other global or universal groups from any domain in the same forest. Domain local groups can be assigned permissions to resources within the same domain or trusted domains.
- Global Groups: Used to group user accounts within the same domain. They can be used to assign permissions within the same domain or to other trusted domains. Global groups cannot contain other global groups.
- Universal Groups: Used to group user accounts, computer accounts, and other groups from any domain in the same forest. They can be used to assign permissions to resources in any domain within the forest. Universal groups are especially useful in multi-domain or multi-forest environments.
Comments
Post a Comment