Where to put domain local groups and global groups

[rriddleone]

Hi,

I'm creating domain local groups and putting global groups within them
for permissions on shares. Where would I be creating and placing these
groups? In their corresponding OU's? What is the norm for where to
create the domain local groups within Active directory Users and
Computers?

Thanks in Advance,

ED

 

[Roger Abell [MVP]]

Hi,

I'm creating domain local groups and putting global groups within them
for permissions on shares. Where would I be creating and placing these
groups? In their corresponding OU's? What is the norm for where to
create the domain local groups within Active directory Users and
Computers?

I am not sure that there is a norm. For groups the membership of which
is not adjustable by users that have had this ability delegated to them,
that
is groups that are only managed by admins, it is convenient to collect them
in a location for easy access. One example is a small structure of
containers
that organize them in convenient categories.
Group that do have their membership delegate out are likely placed into
OUs with which those who manage the memberships are associated.
Similarly, group defined as result of a delegation of the ability to define
groups
normally would end up in the area (OUs) of those with the delegation.
What is probably as or more important is having a good naming convention
so that finding groups when it comes time to pick them for use is easier, so
that the names provide information of their appropriate uses, etc.