Universal Groups in Windows Server 2003

What use do you make of Windows Server 2003's Universal Groups?

Best Practice (Litmus Test)

 

Guy recommends:
Free Solarwinds
VM Console

 A free desktop tool that monitors, or restarts, your VMware virtual machines.  Download your free VM Console

---

 

Professionals: Use Universal Groups sparingly and only for nesting other groups.

Amateurs: Do not know Universal Groups Exist

or

Amateurs: Use only Universal Groups and never Global or Domain Local

What are the two TYPES of Groups in Windows Server 2003?  Hang on Guy, I thought there were three, Global, Domain Local, and Universal?  Microsoft are playing games with words, the two TYPES of groups are Security and Distribution (as in Distribution List).

Microsoft have introduced the Scope attribute to explain the capabilities of groups.  If you are brand new to groups it makes sense, but for old timers it takes a while to get your head around the scope concept.

Domain Local Groups (These used to be plain Local groups). 

Think of domain local groups as great hosts, literally anyone can be a member, users, Global groups, Universal groups, even computers can join a domain local group.  Local groups are bad travellers and only operate in their own domain. 

Best practice is to use local groups to assign permissions to resources like databases and printers.

Global Groups

These are great travellers, they can wander the entire Forest.  The key point is that global groups are poor hosts and can only contain members from their own domain. 

Best practice is to make global group your default group, and for starters, make a group to represent each of your departments.

Universal Groups

Another question for you, why is it sometimes the radio button against create Universal group is greyed out?  The answer is when the Domain is in mixed mode you cannot create universal groups (NT 4.0 BDC's would not understand them).  You need to 'raise domain level to Windows 2000 native before you benefit from universal groups.  Think of universal groups as the ultimate container for nesting groups.  They are good hosts and great travellers.

Best practice is make it rule to only include global groups inside Universal groups, no individual groups. 

Guy Recommends:  Solarwinds' Free Bulk Import Tool

Import users from a spreadsheet.  Just provide a list of the users with their fields in the top row, and save as .csv file.  Then launch this FREE utility and match your fields with AD's attributes, click and import the users.  Optionally, you can provide the name of the OU where the new accounts will be born.

There are also two bonus tools in the free download, and all 3 have been approved by Microsoft:

1. Bulk-import new users into Active Directory.
2. Seek and zap unwanted user accounts.
3. Find inactive computers.

Download your FREE bulk import tool.

Global Catalog Implications

As you would expect, domain local and global groups are listed in the global catalog, however the individual members are not listed.  So changes in global group membership have zero impact on global catalog replication traffic.

Universal groups on the other hand, not only are listed in the global catalog but also the individual users or nested groups are also listed.  Now you can see that adding users to a universal group will generate replication traffic.  That is why Guy says only put global groups inside universal groups, the individual members inside the global groups are not replicated.

In Windows 2000 the situation is that one change of membership to a universal group causes the whole list to be replicated, thankfully that changed in Server 2003, now only incremental changes are replicated not the whole list.

Another Interesting Group are Query-based Distribution Groups.

See more about Windows 8

• Install Windows 8  • When will Windows 8 Expire?  • Windows 8 Metro UI

• Windows 8 Task Manager

 *

Custom Search	Guy Recommends: SolarWinds Free IP SLA Monitor SolarWinds IP SLA Monitor offers so much more than just uncovering network bottlenecks, the real joy is learning about router traffic. To find out what's happening on the network between your computers and their routers, download your free copy of the of IP SLA Monitor.
Home Copyright © 1999-2012 Computer Performance LTD All rights reserved Please report a broken link, or an error.