Windows Server 2016 and later versions such as Windows Server 2019 supports group scope and the scope
of a group determines both the range of groups abilities or permissions and the group membership.
There are four groups schools local domain local global and universal.
Let's discuss each of these scopes local you use this type of group for standalone servers and workstations
on demand member servers that are not domain controllers or On Demand member workstations local groups
are truly local which means that they are available only on the computer where they exist.
The important characteristics of a local group are you can assign abilities and permissions on local
resources.
Only men in on the local computer members can be from anywhere in the 80 days forest and can include
any security principals from the domain such as users computers or global groups or domain local groups.
Members can also include users computer of sound global groups from any domain in the forest or users
computers and global groups from any trusted domain and members can be also universal groups defined
in any domain in the forest.
The next scope is domain local.
You use this type of group primarily to manage access to resources or to assign management responsibilities
or rights domain local groups existing domain controllers and the ADA the US Forest and consequently
the group scope is local to the domain in which they reside.
The important characteristics of domain local groups are that you can assign abilities and permissions
on domain local resources only which means on no computers in the local domain.
Members can be from anywhere in the 80 days forest and can include any security principles from their
domain.
Users computers global groups or domain local groups.
These could be users computers and global groups from any domain in the forest or any trusted domain.
This also can be universal groups defined in any domain in the forest.
The next scope is global.
You can use this type of group primarily to consolidate users who have similar characteristics.
For example you might use global groups to consolidate to users who are part of a department or geographic
location.
The important characteristics of the global groups are that you can assign abilities and permissions
anywhere in the forest and members can be from the local domain only and can include users computers
and global groups from the local domain.
And finally universal scope you can use this type of group most often in Malta domain networks because
it combines the characteristics of both domain local group and Global Group.
Specifically the important characteristics of universal groups are that you can assign abilities and
permissions anywhere in the forest as with global groups and the members can be from anywhere in the
80 days forest and can include user's computer or sound global groups from any domain in the forest.
Members can also be universal groups defined in any domain in the forest Roberta's of universal groups
propagate to their global catalog and are a whaler all across the enterprise network on all domain controllers
that host the global Catskill cattle local role.
This makes universal groups membership lists more accessible which is useful in Malta demands scenarios.
For example if you use a universal group for email distribution purposes you can determine the membership
list more quickly.
In just attributed Mall to demand networks.
No.
Let's summarize the basic properties of the four groups scopes the first group scope is local.
It can include members from domain users domain computers globally groups and universal groups from
any domain in the forest.
It can also include members from domain local groups from the same domain as for assigned permissions
you can assign permissions to local computer resources only within local group scope.
As for can it be converted to any other groups.
In this case it's not applicable.
The next group is domain local within this group scope.
You can include members from domain users domain computers global groups and universal groups from any
domain in the forest.
You can also include domain local groups from the same domain as for permissions they can be assigned
to local domain resources.
Only the domain local school can be converted to universal groups if no other domain local group exists
as member.
Next one is global.
It can include members from domain users domain computer ascend global groups from the same domain can
be assigned permissions to any domain resource in the forest and can be converted to universal groups
if it is not a member of any other global groups.
And finally universal school.
It can include members from domain users domain computers global group sound universal groups from any
domain in the forest.
It can be assigned permissions to I need a main resource in the forest and can be converted to domain
local groups and global groups.
If no other universal groups exist as members.