🌐 Security+ Lab 4.4.14 — Create Global Groups
🌐 Security+ Lab 4.4.14 — Create Global Groups
This lab demonstrates how to create Global Security Groups in an Active Directory environment to organize users by role or department and support scalable, role-based access control (RBAC) across the domain.
🧠 Key Concepts
Global Group Overview:
Global groups are used to group users from the same domain.
They are typically assigned permissions outside the group, such as to domain local groups or resources.
Global groups are a core building block of the AGDLP / AGUDLP permission model.
Group Scope Comparison:
Global:
Members: users from the same domain
Permissions: assigned across domains
Domain Local:
Members: users from any domain
Permissions: local to one domain
Universal:
Members: users from any domain
Permissions: across the forest
Security+ Exam Tip:
Remember: Global groups organize users, Domain Local groups assign permissions, and Universal groups span forests.
▶️ Step 1 — Open Active Directory Users and Computers (ADUC)
Log in to a domain controller or admin workstation.
Open Server Manager → Tools → Active Directory Users and Computers.
Navigate to the appropriate Organizational Unit (OU).
▶️ Step 2 — Create a Global Security Group
Right-click the OU → New → Group.
Enter a descriptive group name (e.g., Finance_Global, IT_Staff_Global).
Under Group scope, select Global.
Under Group type, select Security.
Click OK to create the group.
▶️ Step 3 — Add Users to the Global Group
Open the newly created group.
Select the Members tab.
Click Add and select users from the same domain.
Apply changes.
Best Practice:
Add users to Global groups, not directly to permission groups.
▶️ Step 4 — Use Global Groups in Access Models
AGDLP Model:
Accounts → Global groups → Domain Local groups → Permissions
Example:
Users added to HR_Global
HR_Global added to HR_Share_DL
HR_Share_DL assigned permissions to HR folder
This improves scalability and simplifies management.
▶️ Step 5 — Verify Group Functionality
Log in as a user in the global group.
Confirm correct access to assigned resources.
Ensure no excessive permissions are inherited.
▶️ Step 6 — Document Group Configuration
Record:
Group name and purpose
Scope and type
Members
Associated domain local groups
Creation date and owner
Documentation supports audits and change management.
⚠️ Important Notes for Security+ Exam
Global groups can contain only users from the same domain.
Use Global groups to organize users by role or department.
Combine Global and Domain Local groups for scalable RBAC.
Avoid assigning permissions directly to Global groups on resources in large environments.
Proper group scope selection prevents future redesigns.
#Comptia
#ActiveDirectory
#Global
#RBAC
#Identity