2

Can you nest Security Groups in active directory?

Are there limitations to the nesting?

Which versions of Windows Server/Active Directory support the nesting?

3 Answers 3

8

Yes, AD supports group nesting in domains operating in windows 2000 native mode and higher. The limitations are based on the type of group you have.

There are three types:

  1. Global
  2. Domain Local
  3. Universal

Global Groups can only contain accounts and other global groups from the domain the group resides in. They can be used in any domain within the AD forest (or trusted domains).

Domain Local groups can contain global/ Universal groups, computer objects, and accounts from any domain in the Forest (or trusted domains). The can only be used in the domain the group resides in.

Universal Groups can contain global/ Universal groups, computer objects, and accounts from any domain within the AD forest (or trusted domains). They can be used in any domain within the AD forest (or trusted domain).

Global Catalog severs will cache the members of Universal Groups.

3
  • One addition: a domain local group can contain other domain local groups from the same domain. Oct 14, 2011 at 16:25
  • Are you sure that support didn't start in 2003 Native Mode?
    – JoshRivers
    Oct 14, 2011 at 17:57
  • @JoshRivers The group behavior has not changed since 2000 native mode. Please tell me you aren't in 2000 mixed mode (but even that would just get rid of universal groups). Oct 14, 2011 at 17:59
5

Short version: Yes.

Long version: Yes, but...

Nesting can be limited by the scopes of the groups in play; domain local, global, and universal.

  • A universal group can be a member of a universal group or a domain local group
  • A global group can be a member of any type of group - if it's another global, it must be from the same domain
  • A domain local group can be a member only of other domain local groups in the same domain

See here for more info on group scope here.

Additionally, be careful of badly behaved applications - some applications which read group membership from raw ldap based only on the members attribute of the group or the memberOf attribute of the user will miss the nested memberships.

Also, keep in mind that each group that a user is a member of will add to the size of their kerberos ticket if the group's in security mode. With too much nesting, beware of hitting the ticket size limit.

1

Yes you can. Here are a few helpful articles:

http://technet.microsoft.com/en-us/library/cc783634(WS.10).aspx http://technet.microsoft.com/en-us/library/cc737585(WS.10).aspx

And you can find some scripts enabling to draw/graph nested groups here :

https://gallery.technet.microsoft.com/scriptcenter/Graph-Nested-AD-Security-eaa01644

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .