AD DS Group Nesting Strategy

AD DS supports several group scopes that control where a group can be used:

• Global groups are used within the same domain.
• Domain local groups apply to resources in their own domain.
• Universal groups work across domains in a forest.

Nested group membership means adding one group as a member of another. This reduces the number of permissions you assign directly. Delegation models let administrators grant specific rights over an OU, such as resetting passwords or creating new accounts, without giving full administrative access to the entire domain.