Universal group scope is incorrectly documented in Windows 2000 Help (318862)



The information in this article applies to:

  • Microsoft Windows 2000 Server SP1
  • Microsoft Windows 2000 Server SP2
  • Microsoft Windows 2000 Advanced Server SP1
  • Microsoft Windows 2000 Advanced Server SP2
  • Microsoft Windows 2000 Datacenter Server SP2

This article was previously published under Q318862

SUMMARY

If you open Windows 2000 Help, and then view the table that summarizes the behavior of the different group scopes in Windows 2000, the following table entry is displayed under Universal scope:

In native-mode domains, security groups with universal scope cannot be created.

This information is incorrect.

MORE INFORMATION

The following statement is correct:

In mixed-mode domains, security groups with universal scope cannot be created.

How to View the Table That Summarizes Group Scope Behavior

  1. Click Start, and then click Help.
  2. Click the Index tab.
  3. Type the following keywords:

    Active Directory groups

  4. Under Active Directory groups in the left pane, click scopes, overview, and then click Display.
  5. The incorrect statement is displayed in the second row of the Universal scope column in the table that is displayed in the right pane of Windows 2000 Help.
The following table, which summarizes the behavior of the different group scopes, is correct.

Group CapabilityUniversal scopeGlobal scopeDomain local scope
Native Mode MembershipAccounts from any domain, as well as groups from any domain regardless of scope.Only accounts from the same domain and global groups from the same domain.Accounts, global groups, and universal groups from any domain; domain local groups from the same domain only.
Mixed Mode Membership.Can't be created in mixed-mode domains.Only account from the same domain.Accounts and global groups from any domain.
Member ofCan be put into other groups and assigned permissions in any domain.Can be put into other groups and assigned permissions in any domain.Can be put into other domain local groups and assigned permissions only in the same domain.
Scope ConversionCannot be converted to any other group scope.Can be converted to universal scope, provided it is not a member of any other group having global scope.Can be converted to universal scope, provided it does not have as its member another group having domain local scope.


Note Group membership rules prevent both Universal and Global groups from containing members from another forest, even if there is a cross-forest trust.

Modification Type:MajorLast Reviewed:8/13/2004
Keywords:kbinfo KB318862