Guidelines
for Using
Groups (continued)
nUse universal groups
to provide extensive access to
resources, such as when the Active
Directory contains trees and forests. Make universal groups members of ACLs for objects in any domain, tree, or forest. Manage user account access by placing accounts in global groups and joining those global groups to domain local or universal groups.