Last Updated on August 23, 2026
Microsoft Active Directory is a directory service used heavily on Windows domains. It comes included with the Windows Server operating system and has been around since Windows 2000. Active Directory uses the Lightweight Directory Access Protocol (LDAP) and is responsible for keeping track of all the information on your domain. It stores data for users, groups, computers, servers, printers, and many other objects in its massive database.
It allows administrators to manage all these objects and services from one central location rather than having to go from computer to computer to get things done. Many other modern cloud programs and local services tie into Active Directory to manage user accounts seamlessly. Active Directory has several built-in groups that you can use to assign users or computers so they have the exact permissions they need to get their jobs done.
You can also create your own custom groups and assign those groups various levels of access and permissions. For this article we are going to discuss the main groups you will encounter daily. There are two domain group types with three scope types in each one plus the local security group.
Domain Group Types
The two Domain Groups consist of Security groups and Distribution groups. Within these two groups we have three group scopes which will be discussed next. When creating a new Active Directory group you will need to choose between a Security and Distribution group as well as choose the group scope.
1. Security Groups
Security groups contain users who have various assigned permissions and access to specified network resources. These resources include shared folders, physical printers, and other secured objects. By using a security group, administrators do not need to assign these permissions on a strict user-by-user basis.
2. Security Group Inheritance
You simply create the group with all the permissions assigned to the group itself and then add users to that container. When a user is assigned to a security group, that user inherits all the rights that go along with it instantly. If a user is in more than one security group that applies to the exact same object, the most restrictive rights out of all the groups will take effect.
3. Effective Permissions Example
Let us look at a quick example of how this restriction works in practice. User A has modify access to the Sales folder by being in the Sales group. That same user has read-only access to the Sales folder by being in the Marketing group. User A will ultimately have read-only access to the Sales folder as his effective permissions.
4. Distribution Groups
Distribution groups are used strictly to send emails for internal communication purposes. You avoid having to send the exact same email to 20 different sales people manually. If those 20 people are all in the Sales distribution group, you can send one single email to that address.
5. Email Server Integration
All 20 people in that specific group will get the email delivered to their inbox simultaneously. These types of groups are typically used when you have your email configured on an enterprise email server. Microsoft Exchange heavily relies on these distribution lists to route corporate mail traffic.
Active Directory Group Scopes
When setting up a security or distribution group you will also need to choose a specific scope for that container. This tells Active Directory exactly how to assign the permissions to the resources that group is allowed to access. These scopes determine how far these permissions reach across your infrastructure. They can apply only in the local domain, the domain tree, or across the entire Active Directory forest.
1. Domain Local Group
This group scope type is used to manage permissions and access levels to resources directly in the domain in which it was created. Domain local groups can easily contain global groups, universal groups, and user accounts from any domain. They handle this in addition to managing their own local accounts. Permissions can be granted within the exact same domain only.
2. Global Group
These specific groups are used to hold user accounts and computer accounts strictly within the local domain. They can also be used to provide secure access to resources located in another domain entirely. It can contain user accounts and global groups from the same domain while being a member of domain local and universal groups in any domain. Permissions can be granted on any domain in the same forest as well as trusting external domains and forests.
3. Universal Group
Universal groups are used heavily within massive Active Directory forests. You use them when you need to grant access and manage resources across multiple different domains seamlessly. These complex groups can contain users and groups from absolutely any domain in the forest.
4. Universal Group Limitations
Universal groups can also be active members of domain local groups or other universal groups. They absolutely cannot be members of global groups. Permissions can be granted on any domain in the same forest or a fully trusting external forest.
For additional training resources, check out our online IT training courses.
Check out our extensive IT book series.
