Windows 2000 Security Group Scopes Explained

In Microsoft Windows 2000 Active Directory, security groups are classified into three distinct scopes: Domain Local, Global, and Universal. These scopes define the boundaries of group membership, where the group can be granted access rights, and how group data replicates across the network. Understanding how Windows 2000 processes these scopes is essential for designing an efficient access control strategy and optimizing replication traffic across domains and forests.

Active Directory Domain Modes

The behavior and capabilities of security group scopes in Windows 2000 depend directly on the operational mode of the domain:

  • Mixed Mode: The default mode to maintain backward compatibility with Windows NT 4.0 backup domain controllers. In Mixed Mode, security group nesting is heavily restricted, and Universal security groups are unavailable (only Universal distribution groups can be used).
  • Native Mode: Enabled once all domain controllers are upgraded to Windows 2000. Native Mode unlocks full nesting capabilities and enables the use of Universal security groups.

Group Scopes and Their Characteristics

1. Global Groups

Global groups are primarily designed to organize users who share similar network access requirements (such as job roles or departments).

  • Membership: In Native Mode, a Global group can contain user accounts, computer accounts, and other Global groups from the same domain. It cannot contain members from other domains.
  • Permissions: A Global group can be assigned permissions to resources in any domain within the forest or in any trusting external domain.
  • Replication: Membership lists replicate only among domain controllers within the domain where the group was created. Membership is not replicated to the Global Catalog, keeping wide-area network (WAN) replication overhead low.

2. Domain Local Groups

Domain Local groups are designed to manage and assign permissions directly to local network resources, such as shared folders, printers, and files.

  • Membership: In Native Mode, a Domain Local group can include accounts, Global groups, and Universal groups from any domain in the forest, as well as other Domain Local groups from the same domain.
  • Permissions: A Domain Local group can only be assigned permissions to resources located within the same domain where the group resides.
  • Replication: Membership data stays entirely within the local domain's directory partition and is not published to the Global Catalog.

3. Universal Groups

Universal groups bridge cross-domain administrative needs across the entire Active Directory forest.

  • Membership: In Native Mode, a Universal security group can contain user accounts, computer accounts, Global groups, and other Universal groups from any domain in the forest.
  • Permissions: A Universal group can be assigned permissions to resources located in any domain in the forest.
  • Replication: Both the group object and its complete membership list are published to the Global Catalog. Consequently, whenever a member is added or removed, that change replicates to every Global Catalog server across the entire forest.

How Windows 2000 Processes Security Tokens

When a user logs on to a Windows 2000 domain, the operating system creates an access token containing the user's Security Identifier (SID) and the SIDs of all groups to which the user belongs:

  1. Global Group Processing: At logon, the authenticating Domain Controller (DC) checks the local domain database to resolve the user's Global group memberships and adds their SIDs to the token.
  2. Universal Group Processing: The authenticating DC queries a Global Catalog server to resolve any Universal group memberships across the forest and adds those SIDs to the token.
  3. Domain Local Group Processing: When the user attempts to access a specific resource on a server, the target server contacts a DC in its own domain. That DC evaluates the user's token against the local domain database to determine which Domain Local groups the user belongs to (either directly or via Global/Universal group membership). Those Domain Local SIDs are appended to the authorization context to evaluate access against the resource's Discretionary Access Control List (DACL).

The AGDLP Implementation Model

To process permissions efficiently and minimize Global Catalog replication, Windows 2000 utilizes the AGDLP design guideline:

  • A (Accounts): User accounts are placed into...
  • G (Global Groups): Global groups based on role or business function.
  • DL (Domain Local Groups): Global groups are added to Domain Local groups created specifically for a given resource.
  • P (Permissions): Permissions are assigned directly to the Domain Local group on the resource's access control list.

In large multi-domain environments, the model expands to AGUDLP, where Global groups are consolidated into Universal groups before being nested into Domain Local groups. This limits Universal group membership changes while maintaining centralized access control across multiple domains.