I'm pretty new in active Directory so please be comprehensive.. I'm trying to make some 'sets' of security groups in AD. So I make some groups and members of these groups are groups again..

So I have a MasterGroup with 2 subGroups members. My question is, if I add some users to the MasterGroup, they are also members of the subGroups? The objective is to make a user member of a unique group to make some kind of "membership inheritance".

Maybe something more simple exists in active directory to make this kind of tricks. I'm open to propositions..


If you add some users to the MasterGroup they will not be automatically members of the subGroups. But if you add some users to one of the subGroups, these users will inheredit permissions from the MasterGroup as subGroups are part of the MasterGroup. Please note that the resulting permission will be a combination of MasterGroup permission, subGroup permission and user permissions too.

| improve this answer | |
  • Ok thanks, it is less "natural" in this way but it will make what I want. – bAN Mar 14 '12 at 9:03
  • @bAN What's not natural about it? It makes perfect logical sense. – Dan Mar 14 '12 at 9:09
  • @Dan I was seing the MasterGroup like a set containing the subGroups. In this case I have to make the masterGroup member of all the subGroups he contains and not the reverse as I imagined – bAN Mar 14 '12 at 9:22

Okay, your question is pretty badly worded but I think that's down to a lack of knowledge. I think you'd benefit from reading these Microsoft topics on Active Directory Groups:


In particular, Group Scope and Nested Groups

This isn't intended to be an RTFM answer, but those pages will explain the whole thing in more detail than can be reasonably achieved in an answer here.

If you have the following AD groups

[All Staff]

[Factory Staff]

[Office Staff]

[Assembly Team]

[Engineering Team]

[Sales Team]

[Accounts Team]

You could build a hierarchy as follows:

                                      [All Staff]
                     |                                     |
            [Factory Staff]                        [Office Staff]
                     |                                     |
         -------------------                      ----------------
         |                  |                     |              |

[Assembly Team] [Engineering Team]          [Sales Team] [Accounts Team]
  • Adding a user to [All Staff] will make the user a member of [All Staff]
  • Adding a user to [Factory Staff] will make them a member of [Factory Staff] and [All Staff]
  • Adding a user to [Assembly Team] will make them a member of [Assembly Team] and [Factory Staff] and [All Staff]
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.