AD DS - Group Types and Scope

Group Types

Groups make it easier to manage users and computers

A group helps organize users or computers to make it easier to manage permissions. There are two types of groups: security groups and distributiongroups. When you create a group, you choose the group type. The default group type is the security group.

Distribution Groups vs. Security Groups

Know which type of group to use

The main difference between distribution and security groups is whether permissions and access control can be assigned.

	Distribution Groups	Security Groups
Can permissions and access control be assigned?	No	Yes

Distribution groups are primarily for email

Distribution groups are not security enabled and cannot be given permission to resources. Distribution groups are used mainly by email applications. Sending an email message to a distribution group sends the message to all group members. If you are creating a group solely for email distribution it should be this type of group.  

Security groups control resources

Security groups are security‑enabled, and are used to assign permissions and control access to various resources. You can use a security group for email distribution, but we recommend you keep distribution groups and security groups separate.

Consider that when you add a user to a group, the user’s access token—which authenticates user processes—updates only when the user signs in. Therefore, if the user is currently signed in, the user must sign out and sign back in to update their access token with any changed group memberships.

What are group scopes?

Group scopes determine permissions and abilities

When you create an AD DS group you must also select a group scope. The scope of a group determines both the range of a group’s abilities or permissions, and the group membership. Your choices are: Domain local, Global, and Universal.

Group scopes have different memberships and permissions

Here is a summary table for the three group scopes. Each scope will be explained in more detail on the next pages.

Group scope	Group Membership	Abilities and Permissions
Domain-local	Any user in the forest	Anything in the domain
Global	Any user in the domain	Anything in the forest
Universal	Any user in the forest	Anything in the forest

AD DS - Domain Local, Global and Universal Group

Domain-local groups

Use domain-local groups to manage access to resources or to assign management responsibilities (rights) within the domain. Domain-local groups can include any user in the forest. They can also include users and groups from trusted forests and domains.

The default Builtin container at the domain level includes many domain-local groups. Some of the most important are Account Operators,Administrators, Backup Operators, Print Operators, and Server Operators.

Global Groups

Use global groups to collect similar users

Global groups are primarily used to consolidate users who have similar characteristics. For example, global groups are often used to consolidate users who are part of a department or geographic location.  The Users container has several interesting global groups including Domain Admins, Domain Computers and Domain Users.

Universal Groups

Universal groups span multiple domains

Universal group are used primarily in multi-domain networks because they combine the characteristics of both domain-local groups and global groups. Properties of universal groups are propagated to the global catalog, and are made available across the enterprise network on all domain controllers that host the global catalog role. This makes universal groups’ membership lists more accessible, which is useful in multi-domain scenarios. For example, if a universal group is used for email distribution purposes, the process for determining the membership list typically is quicker in distributed multi-domain networks.

The default Users container has several universal groups including Enterprise Admins, and Schema Admins.

Windows Server - Custom Group

Custom Groups

Always create your own groups

You should try to avoid adding users to the groups that do not have members by default (Account Operators, Backup Operators, Server Operators, and Print Operators). Instead, create custom groups to which you assign permissions and user rights that achieve your business and administrative requirements.

For example, if Scott Mitchell should be able to perform backup operations on a domain controller, but should not be able to perform restore operations that could lead to database rollback or corruption, and should not be able to shut down a domain controller, do not put Scott in the Backup Operators group. Instead, create a group and assign it only the Backup Files And Directories user right, and then add Scott as a member.

Local Groups

Don’t forget about the local groups

Local groups are available on stand-alone servers or workstations, on domain member servers that are not domain controllers, or on domain member workstations. Local groups are truly local, which means that they are available only on the computer where they exist. The important characteristics of a local group are:

• You can assign abilities and permissions on local resources only, meaning on the local computer.
• Members can be from anywhere in the AD DS forest.

Protected Users Group

The Protected Users group has its own ACL

There is a subset of default groups that have significant permissions and user rights related to the management of AD DS. Because of the rights that these groups have, they are protected groups. By default, the protected groups include Account Operators, Administrators, Domain Admins and Enterprise Admins. Members of a protected group receive a copy of an ACL from the protected group.

For example, if you add Jeff Ford to the Account Operators group, his account becomes protected. The Help Desk, which can reset all other user passwords in the Employees OU, cannot reset Jeff's password.

Special Identities

Special identities are groups for which membership is controlled by the operating system

• You cannot view the groups in any list (for example, in Active Directory Users and Computers).
• You cannot view or modify the membership of these special identities.
• You cannot add special identities to other groups.

Use special identities to provide access based on authentication or connection

Special identities cannot be changed. You can, however, use these groups to assign rights and permissions. This means you can use them to provide access to resources based on the type of authentication or connection, rather than the user account.

For example, you could create a folder on a system that allows users to view its contents when they are logged on locally to the system, but that does not allow the same users to view the contents from a mapped drive over the network.

• Anonymous Logon. This identity represents connections to a computer and its resources that are made without supplying a user name and password.
• Authenticated Users. This represents identities that are authenticated. This group does not include Guest, even if the Guest account has a password.
• Everyone. This identity includes Authenticated Users and the Guest account.
• Interactive. This represents users who access a resource while logged on locally to the computer that is hosting the resource, as opposed to accessing the resource over the network. When a user accesses any given resource on a computer to which the user is logged on locally, the user is added automatically to the Interactive group for that resource. Interactive also includes users who log on through a Remote Desktop connection.
• Network. This represents users who access a resource over the network, as opposed to users who are logged on locally at the computer that is hosting the resource. When a user accesses any given resource over the network, the user is added automatically to the Network group for that resource.
• Creator Owner. This represents the security principal that created an object

Best Practices

When planning and implementing groups, you now have several points to remember.

• Avoid assigning permissions and rights directly to user accounts. Use groups to make ongoing maintenance easier.
• When you can, use the built-in groups to simplify administration.
• Nest groups to more efficiently control access to resources in larger organizations.