Groups in Active Directory

AD has exactly two group types: security groups (usable in ACLs — they are security principals) and distribution groups (email lists only — not security-enabled, ignored in ACLs). Every group also has a scope controlling who can be a member and where the group can be granted permissions. Security groups can double as email lists (universal security groups explicitly so), but the security properties are what matter for access control. Group type and scope are bit flags on the groupType attribute.

Scopes

Scope	Members may come from	Permissions granted in	Member of
Local (machine)	Anywhere (domain accounts/groups)	That one machine only	Local groups on that machine; never leaves the SAM
Domain Local	Any domain in the forest + trusted domains/forests	This domain only	Domain Local groups in same domain; local machine groups
Global	This domain only	Any domain in forest + trusting forests	Global (same domain), Domain Local (any domain), Universal
Universal	Any domain in the forest	Any domain in forest + trusting forests	Universal, Domain Local anywhere

Global and Domain Local are near-inverses: Global groups take members only from home but get permissions anywhere; Domain Local groups take members from anywhere but grant permissions only at home. Universal is both at once — and its membership is replicated to every global catalog in the forest, so membership changes are forest-wide replication events.

Conventions worth knowing

• AGDLP / AGLP: accounts → Global groups → Domain Local groups → Permissions. The nesting discipline that keeps scope rules straight at scale.
• Scope conversion is allowed in native-mode domains with restrictions (e.g. Global→Universal only if the group isn’t a member of another Global); type conversion (security ↔ distribution) is free — but converting a security group to distribution silently invalidates every ACE referencing it.
• Default privileged groups (Domain Admins, Enterprise Admins) are protected by AdminSDHolder: their DACLs are periodically reset to a protected template.
• Enterprise Admins (Universal, RID 519) exists only in the forest root and is the highest-value group in the forest — the target SID in trust pivot forgeries.

Offensive relevance

• Recursive group membership mapping is core enumeration (Get-DomainGroupMember -Recurse, net group "Domain Admins" /domain).
• Misscoped or over-delegated groups create weak-permission attack paths — a GenericAll over a group is an AddMember primitive.
• Membership changes are high-fidelity detection events (4728/4732/4756).

Sources

• Active Directory Security Groups — Microsoft Learn
• Group Objects (groupType attribute) — Microsoft Learn
• MS-AUTHSOD: Group Scope — Microsoft Learn
• Changing a Group’s Scope or Type — Microsoft Learn

Related: active-directory-enumeration, active-directory-weak-permissions, active-directory-trusts, active-directory-trust-pivoting, powerview.