What Is Group Nesting

By Author: Shirley Green
Total Articles: 129
Comment this article

Groups can be nested within other groups. The advantage of group nesting is that it requires less work when assigning privileges and permissions MCSA Certification.For example, if a local machine group is created and used to grant Read permission to a set of documents that all employees should have access to, membership in this group will provide any employee the ability to read the documents. However, in a large forest of many domains, adding each user account to the group would be inefficient and unmanageable for many reasons, including the following:
The increased time it would take to add each employee's account as a member in the group.
The time and difficulty involved in determining when a user left the company, and therefore, in determining when the user should be removed from the group.
The difficulty involved in knowing when new employees are added.
The limited knowledge of a particular group's administrator. The administrator in charge of managing the group will be part of the administrative structure of the domain that the computer belongs to.She will ...
... not have knowledge of users in the other domains.
To more easily manage the problem of working with many members in a group, you can adhere to the following best practices MCITP study guides free download regarding group strategy. The strategy uses the employee example, but it can be modified for many circumstances.
Create a global group in each domain for employees.
Place all domain accounts that belong to employees in the global group in their respective domains.Nest the global groups, one for each domain, in the local group. In this example,nesting means to make the global group a member of the local group.
Grant the local group access to all resources that all employees can access.
If access to resources on other servers is required, use a domain local group or create a machine local group where the need is.
Manage the membership of the global groups at the domain level. Instead of placing user accounts directly in the machine local group account, you can create global groups at each domain and each employee's account will be placed in the global group created in free Network+ study guides or her domain.