Alexander’s Blog

Group nesting and membership can get confusing, especially when you are dealing with multiple domains and different types of groups in Windows Server 2000/2003/2008. I have created a table (color-coded to make it more readable) that you may find helpful whether you are designing or troubleshooting group membership, or preparing to take a Microsoft exam.

Here’s how you can read this table. Keep in mind that I have tried to cover both the bases by listing: “Can contain from” and “Can be a member of.” I will use Global Group as an example.

- A Global Group can contain User Accounts from the same domain.

- A Global Group can be a member of Local Groups in the same domain as well as Local Groups in the other domains.

- A Global Group can contain a Global Group from the same domain and a Global Group can be a member of a Global Group in the same domain.