Creating a domain group

Windows Server 2003 enables you to assign permissions to users on the domain by creating groups. You can create groups and add users to the group. After adding the users to the group, you can assign permissions to the group. The group permissions are applied to all the users in the group.

To create a domain group:

1. Select All Programs > Administrative Tools > Active Directory Users and Computers. The Active Directory Users and Computers console appears.

2. Click Built in. The list of groups appears.

3. Select Action > New > Group. The New Object - Group dialog box appears.

The different options on the New Object - Group dialog box are:

> Group name - Specifies the name for the group

> Group name (pre-Windows 2000) - Specifies the group name for computers using a version earlier than Windows 2000

> Group type - Enables to select the group type. Windows Server 2003 supports two types of groups. They are:

• Security: Assigns permissions for Active Directory objects and user rights. In addition to Active Directory objects, security groups also assign permissions for resources on the network.

• Distribution: Enables you to send e-mail to all the users using a single email address. The distribution type of group creates e-mail distribution list in MS-Exchange Server.

> Group scope - Determines the extent to which the permissions are applied to users and groups in the domain. Windows Server 2003 supports universal scope, they are:

• Universal Scope - Assigns permissions to all the objects in the domain under the forest. The universal group can contain user accounts, computer accounts. It also contains global and universal groups from other domains in the forest. You can create groups with universal scope
only when the functionality level of the domain is set to Windows 2000 native and Windows Server 2003.

• Global Scope - Determines that the group can assign permissions to all the objects in the domain under the same forest. A global group can contain only user accounts and global groups of the same domain. You can change a global group to a universal group if the global group is not a member of other global groups in the domain.

• Domain Local Scope - Implies that the group can assign permissions to objects in the same domain only. The domain local groups can contain user and computer accounts from the same domain. It can also contain user and computer accounts from other domains in the same forest. You can convert a domain local group to a universal group if the group does not contain other domain local groups as members.

4. Enter the group name, Sales, in Group name text box.

5. Select the group scope, for example, Domain local.

6. Select the group type, for example, Security.

7. Click OK. Windows Server 2003 creates the domain group and adds it to the Active Directory Users and Computers.