Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

For a long time, I've had trouble understanding how group nesting is supposed to work in a multi-forest AD environment. It seems like there are arbitrary limitations placed on group types, with regards to what groups they can contain. For instance, http://msmvps.com/blogs/acefekay/archive/2012/01/06/using-group-nesting-strategy-ad-best-practices-for-group-strategy.aspx speaks about some of these complexities.

Does anyone know why these limitations exist?

share|improve this question

closed as not constructive by Greg Askew, MDMarra, Scott Pack, mdpc, Ward Jan 8 '13 at 3:05

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer 1

Because having every group existing in the global catalog would vastly increase its size, so only Universal groups are in the GC.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.