Active Directory pros 1

[tk808]

Hello,

I have two domains in a 2k3 native mode forest.

Simple question: I know that if you're to create Universal security or dist. groups, it's best to add global(?) groups as members instead of individual users to save on AD replication data load (someone explain why).

However, wouldn't it be too much clutter to create these global groups just to populate these Univ. groups?

Thanks in advance for letting me pick your brain!

 

[itsp1965]

The reason why you would populate Unviersal groups with global groups instead of individual user objects is in order to eliminate replication traffic. A lot of traffic is generated when individual objects are enumerated as opposed groups which remain farily static. In other words a Universal group with 100 groups will generate less traffic than a Universal group with 2000 user objects. Hope this helps.