Active Directory Security Group Scope

Domain Local Groups are designed for use in assignment of permissions. Global Groups are appropriate for holding together users with similar network needs. Best practice holds that Accounts->Global->DomainLocal<-Permissions.

Organizing users inDomain Local groups will severely limit your ability to grant your users access across the forest or in trusting domains. Unless you have good reason for dropping users to Domain Local Groups, keep them in Globals.

Domain Local Groups are great for adding Global Groups from across the forest to a single group for NTFS permission assignment. They can include users or groups from anywhere in the forest. But they can only be used or seen without your own domain.

Global Groups can contain only users from your own domain, but can be granted permissions across the enterprise.

You may not have Universal groups available becasue the domain is still in Mixed mode. Universal groups and group nesting are only available after switching the network to Native mode.

Sojournist
http://netflood.net