In Active Directory, what is the purpose of a Global Group and when would you assign permissions?

In Active Directory, what is the purpose of a Global Group and when would you assign permissions?

• A. Global Groups are local to a computer only
• B. Global Groups are used to grant permissions across any domain, including trusted domains
• C. Global Groups are used to control computer startup
• D. Global Groups are used to group domain users and assign permissions to resources within the same domain

Answer: (D)

Global groups are used to organize users from a single domain so you can grant them access to resources within that same domain. The group’s scope is domain-wide, meaning its members come from one domain and the permissions you assign to that group apply to resources in that domain. This makes administration easier: you add users to the group once, then assign the needed rights to the group rather than to each user individually. If you need to give someone access to resources in another domain, you don’t grant cross-domain permissions with a global group alone. Instead, you nest the global group into a domain local group in the target domain and assign permissions to that domain local group. This separation of concerns—using global groups for domain-specific membership and domain local groups for resource permissions—helps manage access across a forest. Global groups aren’t tied to a computer, aren’t used to control startup, and don’t grant permissions across any domain by themselves. They are specifically for grouping domain users to assign permissions within the same domain.

Global groups are used to organize users from a single domain so you can grant them access to resources within that same domain. The group’s scope is domain-wide, meaning its members come from one domain and the permissions you assign to that group apply to resources in that domain. This makes administration easier: you add users to the group once, then assign the needed rights to the group rather than to each user individually.

If you need to give someone access to resources in another domain, you don’t grant cross-domain permissions with a global group alone. Instead, you nest the global group into a domain local group in the target domain and assign permissions to that domain local group. This separation of concerns—using global groups for domain-specific membership and domain local groups for resource permissions—helps manage access across a forest.

Global groups aren’t tied to a computer, aren’t used to control startup, and don’t grant permissions across any domain by themselves. They are specifically for grouping domain users to assign permissions within the same domain.