What is the difference between Domain local group and Global group in Active Directory?

What is the difference between Domain local group and Global group in Active Directory?

Domain local groups and Global groups are two types of groups used in Active Directory for organizing and managing users and resources. The main difference between Domain local groups and Global groups is in their scope and the scope of their permissions:

Domain Local Group:

• Domain local groups are used to grant permissions to resources within a single domain.
• They can contain users, Global groups, and Universal groups from any domain in the forest.
• Permissions assigned to a Domain local group apply only within the domain where the group is created.

Global Group:

• Global groups are used to organize users from the same domain who share common access permissions.
• They cannot contain users or groups from other domains.
• Global groups are typically used to assign permissions to resources that are shared within the same domain.

In summary, Domain local groups are used for granting permissions within a domain, while Global groups are used for organizing users within the same domain for common access permissions.