Universal Groups

Posted on 2007-08-07
Medium Priority
Last Modified: 2010-04-18
I have 2 forests with a forest root domain in both, (A and B).  There is a one way forest trust between them so forest B trusts A.  I have several users in forest A in a global group.  Sould I put them in a Universal group and apply the universal group to a resource in domain B ?  

Whats best practice for this ?
Question by:tickleonthetum
LVL 58

Expert Comment

ID: 19644650
That sounds like the way to do it, your trust between forest B and A will mean the universal level group will be accessible.

LVL 51

Accepted Solution

Netman66 earned 2000 total points
ID: 19645749
In the Trusting domain, create a Domain Local group.
Assign permissions to the resource to this new group.
Add the Global Group from the Trusted domain into this Domain Local Group.

Use UGs sparingly.

LVL 31

Expert Comment

by:Toni Uranjek
ID: 19647389
Universal groups are only to be used in single forest with multiple domains environment (my opinion more than three domains). Use global groups in multiple forest scenarios instead as already suggested.

Author Comment

ID: 19648164
thanks guys.

Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Let's recap what we learned from yesterday's Skyport Systems webinar.
It’s time for spooky stories and consuming way too much sugar, including the many treats we’ve whipped for you in the world of tech. Check it out!
Are you ready to implement Active Directory best practices without reading 300+ pages? You're in luck. In this webinar hosted by Skyport Systems, you gain insight into Microsoft's latest comprehensive guide, with tips on the best and easiest way…
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…

621 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question