aleinss
Tue Jan 06 19:36:19 CST 2004
Adam Leinss <aleinss@toughguy.net> wrote in message news:<Xns9467A31E9AEA1aleinsstoughguynet@toughguy.net>...
> "Mark Scott" <mark-scott@yonderblue.co.uk> wrote in
> news:ZEiKb.21$iI2.13@news-binary.blueyonder.co.uk:
>
> > Can someone explain this confusion for me? I created a global
> > group today to assign permissions to a resource in a different
> > domain but it wouldn;t work, I had to use a Domain Local group for
> > that.
> >
> > Global to me means a far reaching group with more "coverage" than
> > a Domain Local (local to the domain) so I assumed that to
> > permission objects outside a domain to use Globals.
> >
> > Any ideas why the naming sounds arse about face?
>
> Global Groups have global scope within a domain boundary and only
> within a domain boundary.
>
> Universal Groups extend past domain boundaries and can be used inside
> (and out of) domains. This requires resources by a GC and therefore
> using Universal Groups should be used sparingly according to Microsoft.
>
> Domain Local Groups are usually used to assign permissions to groups
> and or users to use a specific resource such as a printer or share.
> They have scope only within that domain.
I should clarify that Universal and Global Groups can be assigned
permissions in any domain. However, Global Groups can only contain
members from within its own domain. Domain Local Groups can only
contain members for its domain and cannot be assigned permissions in
other domains.
Adam