Just imagine if the concept of Active Directory groups did not exist. Managing your network resources would be an extremely complicated task, indeed. For example, imagine a folder that contained many subfolders where you had to manage a complex ACL with many different entries. Without groups, every time a user needed access to a subfolder, you would need to browse to that folder and add or remove the individual user. Take this one step further and imagine working with thousands of users and millions of files and folders what a huge mess that would be!

Groups organize users, computers, and other objects and make them easier to manage, so that in the previous scenario you would add groups to the folder ACLs, rather than individual users. Since you'll have far less turnover in the names and types of groups on your network than you will with individual user objects, you can simply control membership to the groups to determine which user has access to what folder. When a new user needs to access a folder, he or she is added to a security group, and when access needs to be revoked, the user is removed. Rights and permissions can be assigned to groups, which will in turn apply these settings to all members of that group.

Three group scopes exist in Windows Server 2003 (these are identical to the group scopes that were introduced in Windows 2000):

• Global groups This type...