Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Can you nest Security Groups in active directory?

Are there limitations to the nesting?

Which versions of Windows Server/Active Directory support the nesting?

share|improve this question

3 Answers 3

up vote 8 down vote accepted

Yes, AD supports group nesting in domains operating in windows 2000 native mode and higher. The limitations are based on the type of group you have.

There are three types:

  1. Global
  2. Domain Local
  3. Universal

Global Groups can only contain accounts and other global groups from the domain the group resides in. They can be used in any domain within the AD forest (or trusted domains).

Domain Local groups can contain global/ Universal groups, computer objects, and accounts from any domain in the Forest (or trusted domains). The can only be used in the domain the group resides in.

Universal Groups can contain global/ Universal groups, computer objects, and accounts from any domain within the AD forest (or trusted domains). They can be used in any domain within the AD forest (or trusted domain).

Global Catalog severs will cache the members of Universal Groups.

share|improve this answer
    
One addition: a domain local group can contain other domain local groups from the same domain. –  Shane Madden Oct 14 '11 at 16:25
    
Are you sure that support didn't start in 2003 Native Mode? –  JoshRivers Oct 14 '11 at 17:57
    
@JoshRivers The group behavior has not changed since 2000 native mode. Please tell me you aren't in 2000 mixed mode (but even that would just get rid of universal groups). –  Shane Madden Oct 14 '11 at 17:59

Short version: Yes.

Long version: Yes, but...

Nesting can be limited by the scopes of the groups in play; domain local, global, and universal.

  • A universal group can be a member of a universal group or a domain local group
  • A global group can be a member of any type of group - if it's another global, it must be from the same domain
  • A domain local group can be a member only of other domain local groups in the same domain

See here for more info on group scope here.

Additionally, be careful of badly behaved applications - some applications which read group membership from raw ldap based only on the members attribute of the group or the memberOf attribute of the user will miss the nested memberships.

Also, keep in mind that each group that a user is a member of will add to the size of their kerberos ticket if the group's in security mode. With too much nesting, beware of hitting the ticket size limit.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.