Admin Tips
- Windows Server 2008/2003/2000/XP/NT Administrator Knowledge Base
  - Windows 2003
    - Admin Tips
      - Active Directory
        Group Membership in Multi-Forest Scenarios

Section(s): Active Directory , Miscellaneous
Published on May 30, 2007.
Last Modified on May 30, 2007.
Last Modified by Mitch Tulloch.
Rating: Not Rated

Clearing up uncertainty around some Microsoft documentation on how groups can be nested.

If your organization has deployed Active Directory in a multi-forest scenario (for example through a merger or acquisition with another company) and you need to add users or groups in one forest to a group in the other forest, the group in the other forest must be a domain local group. You might thing from reading the Microsoft documentation at http://msdn2.microsoft.com/en-us/library/ms677609.aspx that you could also use universal groups for this purpose since it says there that “A universal group can contain other universal groups, global groups and accounts from any domain in any forest”. However, this is incorrect—universal groups can only contain users or groups from the same forest, not from different forests.

Mitch Tulloch was lead author for the Windows Vista Resource Kit from Microsoft Press, which is THE book for IT pros who want to deploy, maintain and support Windows Vista in mid- and large-sized network environments. For more information see www.mtit.com.

About Mitch Tulloch

Mitch Tulloch is a widely recognized expert on Windows administration, networking, and security. He has been repeatedly awarded Most Valuable Professional (MVP) status by Microsoft for his outstanding contributions in supporting users who deploy and use Microsoft platforms, products and solutions. Mitch has published over two hundred articles on different IT websites and magazines, and he has written or contributed to almost two dozen books and is lead author for the Windows 7 Resource Kit from Microsoft Press. For more information, see www.mtit.com .