ADDS Groups

Dsitribution Groups (DLs) for Email
Security Groups (Permissions) and Email

Group Scopes

Global
Domain Local
Universal

Microsoft Strategy

Accounts
- Global
  - Domain Local
    - Permissions

Universal Groups

*For larger organisations multiple globval groups can be linked to a single universal group, which is replicated across all domains

Universal Group Membership Caching Feature

Global Catalog Servers contain a Universal Group List
User Authentication occurs on D.C.s via Kerberos
Kerberos needs to validate with the GCS to identify which groups this user is a member of (via the universal group list)

Scenario: users are finding it take a long time to log in - the global catalog server might be located in a different site to where the user and the domain controller are located

Solutions

Make the D.C. a Global Catalog server (adds processing overhead)
Universal Group Membership Caching
- Every 8 hours (default) domain controller will cache the Universal Group List locally