What are Active Directory Groups?

• Active Directory Groups Definition

  Active Directory Groups Definition

  Active Directory (AD) groups simplify the administration of user accounts or computers in different AD domains by collating them and assigning ubiquitous access rights. Once part of an AD group, a user can easily access all the resources and directory services common to the group without making multiple requests. AD administrators typically use a single reference object for an entire group.
• What are the different types of groups in Active Directory?

  What are the different types of groups in Active Directory?

  AD is a collection of processes and services for securing a network with strong authentication and authorization procedures for users looking to access network resources. Domains, trees, and forests are the fundamental elements helping in the logical, hierarchical organization of the Active Directory. A domain is essentially a pool of objects, such as computers, in a Microsoft AD network and serves as the managerial periphery for these objects. A tree comprises multiple domains, whereas the forest is a collection of multiple trees. Groups in AD simplify and centralize the task of managing network objects and enumerating access permissions to domain resources.

  Types of Active Directory Groups

  AD contains two groups primarily: the security group and the distribution group. Both groups have four different scopes, including universal, global, domain local, and local. Scope helps determine the areas in the domain or forest where a group’s permissions can be enforced successfully. It also helps distinguish the users or computers allowed to join the group and access the directory services without restrictions. Additionally, AD has dynamic and special identity groups.

  Outlined below is a detailed explanation of AD groups:

  • Distribution groups: allow AD admins to create a pool of users to send common messages or emails through Microsoft Exchange and similar apps. All the mail-enabled members of such a group can receive a broadcast message from the admins. However, these groups are not the right option for delegating access rights to network resources due to inadequate security levels.
  • Security groups: simplify user access management by allowing admins to smoothly transfer the permissions to access network resources to a group of users. Admins can create these groups for two objectives mainly: delegating user rights and permissions. User rights help identify the managerial responsibilities of a particular member of the group. For instance, Account Operators group members get the default rights or privileges for managing the accounts of users belonging to local and global groups. Permissions, on the other hand, vary considerably from user rights. Permissions help track the users authorized to access a particular resource on the network, including the type of access, such as Read-only.

  Groups by Scope

  • Universal groups: AD users and groups, both global and universal, from different domains in the forest can join the universal group as members. Two or more universal groups can be nested in the same forest by the directory admin. A universal group can apply for membership in a domain local or local group in the same forest. The users of this group can also access the network resources belonging to any other domain in the forest. Admins can create these groups by applying native domain mode settings. They generally avoid creating such groups while working with a single domain.
  • Global groups: Include users and other global groups from their domain but allows the members to access resources belonging to other trusting domains in the same forest. Nesting of global groups in the same domain is permitted. A global group can also become a subpart of the domain local or universal group from any other domain in the forest. Global groups are beneficial for categorizing employees into different groups based on their roles, such as HR and sales. Network resources like computers in such role-based groups are also named accordingly, such as HR workstations.
  • Domain local groups: Work on the open membership principle allowing admins to include users and groups from the same and other domains while enabling shared access to network resources. However, members of a domain local group can access resources belonging to the same domain only. For every network resource, such as a printer, the admins can create a domain local group containing members from relevant global groups in the same forest. Further, they can assign appropriate user permissions to those resources.
  • Local groups: Are created by network admins using the Microsoft Management Console (MMC) and local Security Account Manager database. Members of this group can access resources on the local computer only. These groups can include domain local groups from the same domain and global and universal groups from another domain in the same forest. Such groups can operate without the assistance of domain controllers, which differentiates them from domain local groups in AD.

  Other Groups

  • Dynamic groups: With the increase in the number of AD users and groups, permissions management often becomes time-consuming and complex for the administrators. AD dynamic groups helps simplify AD group management and prevents over-permissioning by automatically adding or removing users from the group based on specific criteria. For instance, an AD admin can create a dynamic group including users from all the domains who belong to a particular department, such as HR. Creating multiple inclusion and exclusion criteria based on user attributes is also possible for such groups. However, formulating AD dynamic groups is possible using PowerShell scripts and third-party tools only due to the absence of built-in tools.
  • Special identity groups: They have similar characteristics to security groups, but with an exception: memberships are managed automatically in these groups. Once a user accesses a particular resource or logs into any system, the user automatically becomes part of such a group. The option to apply group scope and view and modify memberships is unavailable in these groups. Anonymous Logon, Authenticated Users, Creator Owner, and Local Service are some tables listing such groups.