Local Groups

By Author: Mike Jones
Total Articles: 256

A local group is a collection of CompTIA Security+ certification user accounts on a computer. Use local groups to assign permissions to resources residing on the computer on which the local group is created. Windows Server 2003 creates local groups in the local security database.
Note Because Active Directory groups with a "domain local" scope are sometimes referred to as "local groups," it is important to distinguish between a local group and a group with a domain local scope.
Guidelines for using local groups follow:
Use local groups only on the computer where you create the local groups. Local group permissions provide access to only the resources on the computer where
you created the local group.
Use local groups on computers running Microsoft Windows XP Professional and member servers running Windows Server 2003. Local groups cannot be created on
domain controllers because domain controllers cannot have a security database that is independent of the database in Active Directory.
Use local groups only on computers that do not belong tocomptia certification training a domain. Using local groups on domain computers prevents you from centralizing group administra?
tion. Local groups do not appear in Active Directory, and you must administer local groups separately for each computer.
Membership rules for local groups include the following:
Local groups can contain local user accounts from the computer where you create the local group.
Local groups cannot be members of any other group.
To use nesting efficiently, you must recall the group scope membership rules:
In domains with a domain functional level set to Windows 2000 mixed, only one type of nesting is available: global groups from any domain can be members of
domain local groups. Universal groups do not exist in domains with a domain functional level set to Windows 2000 mixed.
In domains with a domain functional level set to Windows 2000 native or Windows Server 2003, all group membership rules apply and multiple levels of nesting are allowed.
To create domain user accounts, use the Active Directory Users And Computers console. Provide detailed property information for each domain user account that
you create so you can use this free it certification information to search for users in the directory.