For groups intended to include all users in an OU and its sub-OUs, which group scope should be used?

For groups intended to include all users in an OU and its sub-OUs, which group scope should be used?

• A. Local
• B. Universal
• C. Global
• D. Domain Local

Answer: (C)

Group scope determines where you can add members and where the group’s permissions can be applied. To include all users in an OU and every sub‑OU, you want a scope that can hold accounts from within the same domain across that whole tree, and that’s a Global group. Global groups are designed to contain user and computer accounts from a single domain, including those in sub‑OUs, so you can add all relevant users from that OU subtree to the group and grant the group access to resources as needed. Using a Global group keeps membership manageable within one domain, without the cross‑domain replication overhead of Universal groups. Domain Local groups are intended for granting permissions within a single domain to members from any domain, which isn’t the primary need here, and Local isn’t a valid AD scope.

Group scope determines where you can add members and where the group’s permissions can be applied. To include all users in an OU and every sub‑OU, you want a scope that can hold accounts from within the same domain across that whole tree, and that’s a Global group. Global groups are designed to contain user and computer accounts from a single domain, including those in sub‑OUs, so you can add all relevant users from that OU subtree to the group and grant the group access to resources as needed. Using a Global group keeps membership manageable within one domain, without the cross‑domain replication overhead of Universal groups. Domain Local groups are intended for granting permissions within a single domain to members from any domain, which isn’t the primary need here, and Local isn’t a valid AD scope.