Not that they only have different scope, they also have different purposes.
See
http://www.microsoft.com/resources/.../proddocs/en-us/sag_ADgroups_3groupscopes.asp
for explanation. Generally you should use DL groups for setting permission
on resources, global and universal to group your users according to your
organizational schema. Of course there is difference between universal and
global. Universal groups are... well universal that means, that they are
visible in any domain in the forest. That is why they live in global catalog
and not in specific domain controller. If they live in GC, that means that
if you have multiple domain model, they must be fairly static as constantly
changing U groups causes GC replication around the network...
--
Regards
Matjaz Ladava, ladava.com
MCSA, MCSE, MCT
Microsoft MVP Windows Server - Directory Services
e-mail: (e-mail address removed), (e-mail address removed)
