AD group types
Group scopes link
| Scope | Possible Members | Scope Conversion | Can Grant Permissions | Possible Member of |
|---|---|---|---|---|
| Universal | Accounts from any domain in the same forestGlobal groups from any domain in the same forestOther Universal groups from any domain in the same forest | Can be converted to Domain Local scopeCan be converted to Global scope if the group does not contain any other Universal groups | On any domain in the same forest or trusting forests | Other Universal groups in the same forestDomain Local groups in the same forest or trusting forestsLocal groups on computers in the same forest or trusting forests |
| Global | Accounts from the same domainOther Global groups from the same domain | Can be converted to Universal scope if the group is not a member of any other global group | On any domain in the same forest, or trusting domains or forests | Universal groups from any domain in the same forestOther Global groups from the same domainDomain Local groups from any domain in the same forest, or from any trusting domain |
| Domain Local | Accounts from any domain or any trusted domainGlobal groups from any domain or any trusted domainUniversal groups from any domain in the same forestOther Domain Local groups from the same domainAccounts, Global groups, and Universal groups from other forests and from external domains | Can be converted to Universal scope if the group does not contain any other Domain Local groups | Within the same domain | Other Domain Local groups from the same domainLocal groups on computers in the same domain, excluding built-in groups that have well-known SIDs |