Group Scope

A way of classifying a group is by defining its scope. This means determining what locations the members can come from, and where the resources can be located that the group can be granted access permissions to. In Table 4, the first column lists the scope of the group object (Domain Local, Global, or Universal), the second column lists the object types that can be members of this kind of group, and the third column lists the locations of the resources that a group can be given access to. Note that in several cases, the characteristics of the group object differ depending on the functionality of the domain.

Table 4. Group Scopes and Applicable Members and Rights

Scope	Can Include	Can Be Granted Access to Resources In...
Domain Local	Accounts, Global groups, and Universal groups from any domain and Windows 2000 native or in Windows Server 2003 functionality level domains, other Domain Local groups from the same domain as the group object.	The local domain
Global	In domains at the Windows 2000 mixed level or at the Windows Server 2003 interim level, only accounts from the same domain as the group object. In Windows 2000 native or Windows Server 2003 functional level domains, accounts and other global groups from the same domain as the group object.	Any domain in the forest and any domain in any other forest that trusts the local domain
Universal	(Not available in domains at the Windows 2000 mixed level or the Windows Server 2003 interim level.) Accounts, Global groups, and Universal groups from any domain.	Any domain in the forest and any domain in any other forest that trusts the local domain