Can you nest Security Groups in active directory?
Are there limitations to the nesting?
Which versions of Windows Server/Active Directory support the nesting?
Yes, AD supports group nesting in domains operating in windows 2000 native mode and higher. The limitations are based on the type of group you have.
There are three types:
Global Groups can only contain accounts and other global groups from the domain the group resides in. They can be used in any domain within the AD forest (or trusted domains).
Domain Local groups can contain global/ Universal groups, computer objects, and accounts from any domain in the Forest (or trusted domains). The can only be used in the domain the group resides in.
Universal Groups can contain global/ Universal groups, computer objects, and accounts from any domain within the AD forest (or trusted domains). They can be used in any domain within the AD forest (or trusted domain).
Global Catalog severs will cache the members of Universal Groups.
Yes you can. Here are a few helpful articles:
And you can find some scripts enabling to draw/graph nested groups here :
Short version: Yes.
Long version: Yes, but...
Nesting can be limited by the scopes of the groups in play; domain local, global, and universal.
See here for more info on group scope here.
Additionally, be careful of badly behaved applications - some applications which read group membership from raw ldap based only on the
Also, keep in mind that each group that a user is a member of will add to the size of their kerberos ticket if the group's in security mode. With too much nesting, beware of hitting the ticket size limit.