Design Guidelines

When designing security groups, remember the following:

• Add user accounts to global groups rather than universal or local domain groups.

  Try to create a global group within each domain for each job description. Create further groupings by nesting the global groups within other global groups. These groupings will minimize the replication time, because only the base global group memberships should change on a regular basis.

• Add global groups to universal groups.

  Because universal group membership is replicated to all global catalog servers every time a member changes, try to keep the universal group membership static. Instead of creating redundant universal groups, use nesting whenever possible.

• Add global and universal groups to domain local groups as needed.

  Usually, you only need to add global groups to the domain local groups. Placing global groups into a universal group and then adding the universal group to a domain local group is possible. However, creating a universal group solely for this purpose is not recommended, because the security needs of each global group may change.

• Grant rights and assign permissions to domain local groups.

  Use domain local groups instead of global or universal groups, for greater flexibility and less complex administration.

• Delegate the authority to manage group memberships.

  This allows the resource owners to manage access to their resource in the domain local groups, and assistant administrators to manage the membership of global groups. However, only Enterprise Admins can manage the membership of universal groups.