Administering Windows Server Hybrid Core Infrastructure (AZ-800) Practice

What scope of group can be assigned permissions anywhere in an Active Directory Domain Services forest?

1. Global

2. Universal

3. Domain local

4. Local

The correct answer is: Universal

A universal group is designed to be assigned permissions across an entire Active Directory Domain Services (AD DS) forest. This type of group allows for the inclusion of members from any domain within the forest, making it versatile for multi-domain environments. Universal groups are ideal for scenarios where you need to manage resources and permissions that span multiple domains, as they are replicated to all domain controllers in the forest. This replication ensures that the membership and scope of the universal group are consistent and accessible across different domains. Global groups, while also helpful for organizing user accounts, can only contain users from their own domain and are typically used for granting permissions within the same domain. Domain local groups are meant for granting permissions to resources only within the domain in which they are created, and they cannot include members from external domains without the use of universal groups or global groups. Lastly, local groups typically refer to groups that are specific to local machines rather than Active Directory, thus limiting their scope and functionality further. Understanding the distinctions between these group scopes highlights why universal groups are the preferred choice for assigning permissions across an entire Active Directory forest.