Domain Local groups (clarification)

OCdude · 27 Apr 2011 at 16:54

I'm "pretty" sure i'm right, but i just wanted to run this past someone else, just in case i'm misunderstanding anything here!

Okay so i'm studying for the 640 exam right now (Server 2008 Active Directory) and i'm revising the various types of security groups and how best to utilise them (AGUDLP etc).

Now, upon re-reading one of the course DVDs I have, i noticed this statement in the end of chapter round-up:

Surely that is wrong, as members of Domain Local groups can be users, global groups and universal groups from ANY domain in the forest, right?

If i'm wrong then i'm going to immediately throw my books out the window

OCdude · 27 Apr 2011 at 19:52

m4cc45 said:
Seems correct to me.

M.

Me, or the DVD :eek:

OCdude · 3 May 2011 at 18:08

Right I just checked Technet: http://technet.microsoft.com/en-us/library/cc755692(WS.10).aspx

Clearly says that the members of a domain local group can contain accounts/global groups/universal groups from any domain!

OCdude · 3 May 2011 at 20:23

m4cc45 said:
Well.. the bit you're missing is that, whilst the members themselves can be from other domains, you can't assign permissions so the book is correct.

M.

I understand that bit and I'm not disputing that, I'm just disputing where the members of the domain local group can come from. The book says "Users can only be from the domain it lives in" which is wrong... unless he maybe meant "Uses" but not "users"? lol :S