Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm pretty new in active Directory so please be comprehensive.. I'm trying to make some 'sets' of security groups in AD. So I make some groups and members of these groups are groups again..

So I have a MasterGroup with 2 subGroups members. My question is, if I add some users to the MasterGroup, they are also members of the subGroups? The objective is to make a user member of a unique group to make some kind of "membership inheritance".

Maybe something more simple exists in active directory to make this kind of tricks. I'm open to propositions..

share|improve this question
up vote 2 down vote accepted

If you add some users to the MasterGroup they will not be automatically members of the subGroups. But if you add some users to one of the subGroups, these users will inheredit permissions from the MasterGroup as subGroups are part of the MasterGroup. Please note that the resulting permission will be a combination of MasterGroup permission, subGroup permission and user permissions too.

share|improve this answer
Ok thanks, it is less "natural" in this way but it will make what I want. – bAN Mar 14 '12 at 9:03
@bAN What's not natural about it? It makes perfect logical sense. – Dan Mar 14 '12 at 9:09
@Dan I was seing the MasterGroup like a set containing the subGroups. In this case I have to make the masterGroup member of all the subGroups he contains and not the reverse as I imagined – bAN Mar 14 '12 at 9:22

Okay, your question is pretty badly worded but I think that's down to a lack of knowledge. I think you'd benefit from reading these Microsoft topics on Active Directory Groups:

In particular, Group Scope and Nested Groups

This isn't intended to be an RTFM answer, but those pages will explain the whole thing in more detail than can be reasonably achieved in an answer here.

If you have the following AD groups

[All Staff]

[Factory Staff]

[Office Staff]

[Assembly Team]

[Engineering Team]

[Sales Team]

[Accounts Team]

You could build a hierarchy as follows:

                                      [All Staff]
                     |                                     |
            [Factory Staff]                        [Office Staff]
                     |                                     |
         -------------------                      ----------------
         |                  |                     |              |

[Assembly Team] [Engineering Team]          [Sales Team] [Accounts Team]
  • Adding a user to [All Staff] will make the user a member of [All Staff]
  • Adding a user to [Factory Staff] will make them a member of [Factory Staff] and [All Staff]
  • Adding a user to [Assembly Team] will make them a member of [Assembly Team] and [Factory Staff] and [All Staff]
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.