Can you nest Security Groups in active directory?
Are there limitations to the nesting?
Which versions of Windows Server/Active Directory support the nesting?
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
Yes, AD supports group nesting in domains operating in windows 2000 native mode and higher. The limitations are based on the type of group you have.
There are three types:
Global Groups can only contain accounts and other global groups from the domain the group resides in. They can be used in any domain within the AD forest (or trusted domains).
Domain Local groups can contain global/ Universal groups, computer objects, and accounts from any domain in the Forest (or trusted domains). The can only be used in the domain the group resides in.
Universal Groups can contain global/ Universal groups, computer objects, and accounts from any domain within the AD forest (or trusted domains). They can be used in any domain within the AD forest (or trusted domain).
Global Catalog severs will cache the members of Universal Groups.
Short version: Yes.
Long version: Yes, but...
Nesting can be limited by the scopes of the groups in play; domain local, global, and universal.
See here for more info on group scope here.
Additionally, be careful of badly behaved applications - some applications which read group membership from raw ldap based only on the
members attribute of the group or the
memberOf attribute of the user will miss the nested memberships.
Also, keep in mind that each group that a user is a member of will add to the size of their kerberos ticket if the group's in security mode. With too much nesting, beware of hitting the ticket size limit.
Yes you can. Here are a few helpful articles:
And you can find some scripts enabling to draw/graph nested groups here :