question about w2k active directory groups (domain local, global, etc.)

[jjyiz28]

correct me if im wrong. in the NT 4 domain days, a file server that has a shared folder, will first create a machine local group on the computer. assign permissions to the file share to that machine local group. add global groups in the machine local group. and finally users in the global group.

in 2k native domain, i have a file server w/shared folder. create a domain local group in the active directory. assign permissions to that domain local group on the shared folder. add global groups in the domain local group. then add users to the global group.

can i substitute a machine local group to the domain local group??? what is the best practice??

also read that i can change from DL or global groups into universal, but not universal back to DL or global. but i tried it out, and it didn't complain when i change from universal to global. what gives??

 

[Wrench00]

I am lazy I make Local Group assign the users to it then Make that Part of Doman Group. Much easier to change Local groups then domain groups.