Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What is the basic difference between local, global and universal groups in Active Directory? What is the best practice when assigning users and groups to these groups?

share|improve this question
up vote 1 down vote accepted

The difference is which groups/users you can include in the different groups, which permissions can be assigned to that group, and if the group can be converted.

If you only have one domain and one tree, and you know it will stay that way forever, you really don't need to know a lot about this. But, i strongly encourage you to read this:

You will hate the person who set up groups in the first place if you ever have to fix their mistake. I've had to, and it is no fun.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.