0
Wiki User
∙ 13y agowhen the domain fucntional level is
Windows 2000 native or Windows Server 2003:
You can convert universal groups to domain local groups or to global groups
Add your answer:
Earn +20 pts
What is the primary difference between global and universal groups?
Universal groups add more data to the global catalog.
When can a domain local group be converted to a universal group?
Always, because it has no restrictions when the domain functional level is •Windows 2000 native or Windows Server 2003: You can convert universal groups to domain local groups or to global groups
What is the server that provides quick object access universal groups and UPNs within an AD forest?
Global catalog...The global catalog provides quick object access to universal groups and UPNs within an AD forest.
What letters represent the general principle used when assigning users to groups in a large forest?
AGUDLP A - Add users to G - Global groups based on job functions. Add global groups to U - Universal groups for forestwide use. Add universal groups to DL - Domain Local groups that are matched to a particular resource. Assign P - Permissions to the domain local group.
What type of groups would you use when configuring distribution groups in a multiple domain forest?
Use Universal distribution groups in a multiple-domain environment. The membership of universal distribution groups is replicated to each global catalog server in each domain
What is a group scope and what are the different types of group scopes?
Group scopes determine where in the Active Directory forest a group is accessible and what objects can be placed into the group. Windows Server 2003 includes three group scopes: global, domain local, and universal.
What can only contain members from the same domain?
Global groups dude. this is what my book says "global groups can contain user accounts, computer accounts, and/ or other global groups ONLY from within the same domain as the global group. domain local groups can contain user accounts, computer accounts, global groups, and universal groups from ANY domain, IN ADDITION to other domain local groups from the same domain. u take ur pick.....
What can only contain members from within the same domain?
Global groups dude. this is what my book says "global groups can contain user accounts, computer accounts, and/ or other global groups ONLY from within the same domain as the global group. domain local groups can contain user accounts, computer accounts, global groups, and universal groups from ANY domain, IN ADDITION to other domain local groups from the same domain. u take ur pick.....
What are the advantages of using universal groups in a single domain infrastructure?
Universal groups can be used anywhere in the same Windows forest. They are only available in a Native-mode enterprise. Universal groups may be an easier approach for some administrators because there are no intrinsic limitations on their use. Users can be directly assigned to Universal groups, they can be nested, and they can be used directly with access-control lists to denote access permissions in any domain in the enterprise. Universal groups are stored in the global catalog (GC); this means that all changes made to these groups engender replication to all global catalog servers in the entire enterprise. Changes to universal groups must therefore be made only after a careful examination of the benefits of universal groups as compared to the cost of the increased global catalog replication load. If an organization has but a single, well-connected LAN, no performance degradation should be experienced, while widely dispersed sites might experience a significant impact. Typically, organizations using WANs should use Universal groups only for relatively static groups in which memberships change rarely
Which group scope modifications in server 2003 are not permitted?
global to universal,universal of global, global to domain local
What group types cannot be created when a domain is configured to the Windows Server 2000 mixed domain functional level?
universal groups are not present in the win2000 mixed mode the forest level needs to be win2003 for it to work. Universal groups can be used anywhere in the same Windows forest. They are only available in a Native-mode enterprise. Universal groups may be an easier approach for some administrators because there are no intrinsic limitations on their use. Users can be directly assigned to Universal groups, they can be nested, and they can be used directly with access-control lists to denote access permissions in any domain in the enterprise. Universal groups are stored in the global catalog (GC); this means that all changes made to these groups engender replication to all global catalog servers in the entire enterprise. Changes to universal groups must therefore be made only after a careful examination of the benefits of universal groups as compared to the cost of the increased global catalog replication load. If an organization has but a single, well-connected LAN, no performance degradation should be experienced, while widely dispersed sites might experience a significant impact. Typically, organizations using WANs should use Universal groups only for relatively static groups in which memberships change rarely
What are two group types and three group scopes?
â– Security groups Security groups are used to group domain users into a single administrative unit. Security groups can be assigned permissions and can also be used as e-mail distribution lists. Users placed into a group inherit the permissions assigned to the group for as long as they remain members of that group. Windows itself uses only security groups. â– Distribution groups These are used for nonsecurity purposes by applications other than Windows. One of the primary uses is within an e-mail As with user accounts, there are both local and domain-level groups. Local groups are stored in a local computer's security database and are intended to control resource access on that computer. Domain groups are stored in Active Directory and let you gather users and control resource access in a domain and on domain controllers Group scopes determine where in the Active Directory forest a group is accessible and what objects can be placed into the group. Windows Server 2003 includes three group scopes: global, domain local, and universal. â– Global groups are used to gather users that have similar permissions requirements. Global groups have the following characteristics: 1. Global groups can contain user and computer accounts only from the domain in which the global group is created. 2. When the domain functional level is set to Windows 2000 native or Windows Server 2003 (i.e., the domain contains only Windows 2000 or 2003 servers), global groups can also contain other global groups from the local domain. 3. Global groups can be assigned permissions or be added to local groups in any domain in a forest. â– Domain local groups exist on domain controllers and are used to control access to resources located on domain controllers in the local domain (for member servers and workstations, you use local groups on those systems instead). Domain local groups share the following characteristics: 1. Domain local groups can contain users and global groups from any domain in a forest no matter what functional level is enabled. 2. When the domain functional level is set to Windows 2000 native or Windows Server 2003, domain local groups can also contain other domain local groups and universal groups. â– Universal groups are normally used to assign permissions to related resources in multiple domains. Universal groups share the following characteristics: 1. Universal groups are available only when the forest functional level is set to Windows 2000 native or Windows Server 2003. 2. Universal groups exist outside the boundaries of any particular domain and are managed by Global Catalog servers. 3. Universal groups are used to assign permissions to related resources in multiple domains. 4. Universal groups can contain users, global groups, and other universal groups from any domain in a forest. 5. You can grant permissions for a universal group to any resource in any domain
