Administer Active Directory - MCSA Windows Server 2012 R2: Installation and Configuration Study Guide - page 277

Understanding Groups

Now that you know how to create user accounts, it's time to learn how to create group
accounts. As an instructor, I am always amazed when students (who work in the IT field)
have no idea why they should use groups. This is something every organization should
be using.
To illustrate their usefulness, let's say you have a Sales department user by the name of
wpanek. Your organization has 100 resources shared on the network for users to access.
Because wpanek is part of the Sales department, he has access to 50 of the resources.
The Marketing department uses the other 50. If the organization is not using groups and
wpanek moves from Sales to Marketing, how many changes do you have to make? The
answer is 100. You have to move him out of the 50 resources he currently can use and place
his account into the 50 new resources that he now needs.
Now let's say that you use groups. The Sales group has access to 50 resources, and the
Marketing group has access to the other 50. If wpanek moves from Sales to Marketing,
you need to make only two changes. You just have to take wpanek out of the Sales group
and place him in the Marketing group. Once this is done, wpanek can access everything he
needs to do his job.

Group Properties
Now that you understand why you should use groups, let's go over setting up groups and
their properties. When you are creating groups, it helps to understand some of the options
that you need to use.
Group Type You can choose from two group types: security groups and distribution

groups.
Security Groups These groups can have rights and permissions placed on them. For
example, if you want to give a certain group of users access to a particular printer, but
you want to control what they are allowed to do with this printer, you'd create a security
group and then apply certain rights and permissions to this group.
Security groups can also receive emails. If someone sent an email to the group, all users
within that group would receive it (as long as they have a mail system that allows for
mail-enabled groups, like Exchange).
Distribution Groups These groups are used for email only (as long as they have a mail
system that allows for mail-enabled groups, like Exchange). You cannot place permis-
sions and rights for objects on this group type.
Group Scope When it comes to group scopes, you have three choices.
Domain Local Groups Domain local groups are groups that remain in the domain
in which they were created. You use these groups to grant permissions within a single
domain. For example, if you create a domain local group named HPLaser, you cannot
use that group in any other domain, and it has to reside in the domain in which you
created it.