Which group conversion is allowed domain local to universal global to local domain to global universal to global?

Which group scope modifications in server 2003 are not permitted?

global to universal,universal of global, global to domain local

Which of the following are considered group scopes?

Global, Universal, and Domain Local

What is the difference between a domain local group global group and a universal group?

Global Group: Members of Global Group can come only from local domain but members can access resources in any domain. Domain Local Group: Members of Local Group can come from any domain but members can access resources only in local domain. Universal Group: Members can come from any domain and members can access resource in any domain. Hope this is easy:)

When can a domain local group be converted to a universal group?

Always, because it has no restrictions when the domain functional level is •Windows 2000 native or Windows Server 2003: You can convert universal groups to domain local groups or to global groups

What is a group scope and what are the different types of group scopes?

Group scopes determine where in the Active Directory forest a group is accessible and what objects can be placed into the group. Windows Server 2003 includes three group scopes: global, domain local, and universal.

What can only contain members from the same domain?

Global groups dude. this is what my book says "global groups can contain user accounts, computer accounts, and/ or other global groups ONLY from within the same domain as the global group. domain local groups can contain user accounts, computer accounts, global groups, and universal groups from ANY domain, IN ADDITION to other domain local groups from the same domain. u take ur pick.....

What type of groups would you use when configuring distribution groups in a multiple domain forest?

Use Universal distribution groups in a multiple-domain environment. The membership of universal distribution groups is replicated to each global catalog server in each domain

What can only contain members from within the same domain?

Global groups dude. this is what my book says "global groups can contain user accounts, computer accounts, and/ or other global groups ONLY from within the same domain as the global group. domain local groups can contain user accounts, computer accounts, global groups, and universal groups from ANY domain, IN ADDITION to other domain local groups from the same domain. u take ur pick.....

Can you convert global groups to universal?

yes you can scientifically speaking from the diverse of biology that it can be converted using specific things i can now tell this answer was 100% made up

What are two group types and three group scopes?

â–  Security groups Security groups are used to group domain users into a single administrative unit. Security groups can be assigned permissions and can also be used as e-mail distribution lists. Users placed into a group inherit the permissions assigned to the group for as long as they remain members of that group. Windows itself uses only security groups. â–  Distribution groups These are used for nonsecurity purposes by applications other than Windows. One of the primary uses is within an e-mail As with user accounts, there are both local and domain-level groups. Local groups are stored in a local computer's security database and are intended to control resource access on that computer. Domain groups are stored in Active Directory and let you gather users and control resource access in a domain and on domain controllers Group scopes determine where in the Active Directory forest a group is accessible and what objects can be placed into the group. Windows Server 2003 includes three group scopes: global, domain local, and universal. â–  Global groups are used to gather users that have similar permissions requirements. Global groups have the following characteristics: 1. Global groups can contain user and computer accounts only from the domain in which the global group is created. 2. When the domain functional level is set to Windows 2000 native or Windows Server 2003 (i.e., the domain contains only Windows 2000 or 2003 servers), global groups can also contain other global groups from the local domain. 3. Global groups can be assigned permissions or be added to local groups in any domain in a forest. â–  Domain local groups exist on domain controllers and are used to control access to resources located on domain controllers in the local domain (for member servers and workstations, you use local groups on those systems instead). Domain local groups share the following characteristics: 1. Domain local groups can contain users and global groups from any domain in a forest no matter what functional level is enabled. 2. When the domain functional level is set to Windows 2000 native or Windows Server 2003, domain local groups can also contain other domain local groups and universal groups. â–  Universal groups are normally used to assign permissions to related resources in multiple domains. Universal groups share the following characteristics: 1. Universal groups are available only when the forest functional level is set to Windows 2000 native or Windows Server 2003. 2. Universal groups exist outside the boundaries of any particular domain and are managed by Global Catalog servers. 3. Universal groups are used to assign permissions to related resources in multiple domains. 4. Universal groups can contain users, global groups, and other universal groups from any domain in a forest. 5. You can grant permissions for a universal group to any resource in any domain

What is GCs and Universal Groups?

Every domain controller in a forest stores three full writable directory partitions: a domain directory partition, a schema directory partition, and a configuration directory partition. A Global Catalog is a domain controller that stores these writable directory partitions, as well as a partial, read-only copy of all other domain directory partitions in the forest. The additional directory partitions are "partial" because, although they collectively contain every object in the directory, only a limited set of specific attributes are included for each object. The Global Catalog is built automatically by the Active Directory replication system.All of the directory partitions on a Global Catalog server, whether full or partial partitions, are stored in a single directory database (Ntds.dit) on that server. There is no separate storage area for Global Catalog attributes; they are treated as additional information in the domain controller directory database.When a new domain is added to the forest, the information about the new domain is stored in the configuration directory partition, which reaches the Global Catalog server (and all domain controllers) through replication of forest-wide information. When a new Global Catalog server is designated, this information is also stored in the configuration directory partition and replicated to all domain controllers in the forest.Universal Group MembershipThe reason that a Global Catalog must be available for the domain logon process is that the membership for universal groups is not stored on all domain controllers. Because the membership of all universal groups is replicated to Global Catalog servers, the complete universal group membership of a user can be determined by querying a Global Catalog server. Universal groups are available only when a domain is in native mode.During the logon process, a security token that contains the groups to which the user belongs is associated with the user. Because universal group membership is stored only on Global Catalog servers, only these servers can identify a user as having membership in a specific universal group. If a universal group is present as an access control entry in an access control list on a specific directory object, the access token associated with the user during the logon session must contain that group in order for the Allow or Deny access permission to be applied to the user. Otherwise, a user could be granted access (on the basis of another group membership) to an object that is specifically denied that user as a member of the universal group. Similarly, this user would not be able to gain access to resources to which he or she has legitimate access as a member of the universal group.

What letters represent the general principle used when assigning users to groups in a large forest?

AGUDLP A - Add users to G - Global groups based on job functions. Add global groups to U - Universal groups for forestwide use. Add universal groups to DL - Domain Local groups that are matched to a particular resource. Assign P - Permissions to the domain local group.