«

not sure if this is the right group, but I'll give it a try.

from
http://technet2.microsoft.com/Window...79d93e46-ecab-...



Changing group scope
When creating a new group, by default, the new group is configured as a

security group with global scope regardless of the current domain
functional level. Although changing a group scope is not allowed in
domains with a domain functional level set to Windows 2000 mixed, the
following conversions are allowed in domains with the domain functional

level set to Windows 2000 native or Windows Server 2003:


· Global to universal. This is only allowed if the group you want to
change is not a member of another global scope group.


· Domain local to universal. This is only allowed if the group you
want to change does not have another domain local group as a member.


· Universal to global. This is only allowed if the group you want to
change does not have another universal group as a member.


· Universal to domain local. No restrictions for this operation.


My question is about the last "Universal to domain local" which it says

there are no restrictions. What happens if the universal group you want

to convert to domain local is a member of another universal group? This

would cause the containing universal group to have a domain-local group

as a member. If there are no restrictions, wouldn't this cause issues
because a universal group cannot contain domain local groups?

All gawked in amazement when: kcsteele assaulted us with:
> not sure if this is the right group, but I'll give it a try.
>
> from
> http://technet2.microsoft.com/Window...79d93e46-ecab-...
>
>
>
> Changing group scope
> When creating a new group, by default, the new group is configured as
> a
>
> security group with global scope regardless of the current domain
> functional level. Although changing a group scope is not allowed in
> domains with a domain functional level set to Windows 2000 mixed, the
> following conversions are allowed in domains with the domain
> functional
>
> level set to Windows 2000 native or Windows Server 2003:
>
>
> · Global to universal. This is only allowed if the group you want to
> change is not a member of another global scope group.
>
>
> · Domain local to universal. This is only allowed if the group you
> want to change does not have another domain local group as a member.
>
>
> · Universal to global. This is only allowed if the group you want to
> change does not have another universal group as a member.
>
>
> · Universal to domain local. No restrictions for this operation.
>
>
> My question is about the last "Universal to domain local" which it
> says
>
> there are no restrictions. What happens if the universal group you
> want
>
> to convert to domain local is a member of another universal group?
> This
>
> would cause the containing universal group to have a domain-local
> group
>
> as a member. If there are no restrictions, wouldn't this cause issues
> because a universal group cannot contain domain local groups?

What happened when you tried it in your test environment?

--
LRM
MCNGP 7^2
www.mcngp.com home of the bogosity singularity.

Well I got around to testing it and sure enough it doesn't work - AD
complains "a local group can only be a member of other local groups in
the same domain".

Not sure why every place I've looked says that there are "no
restrictions" for converting universal to domain-local groups... any
ideas?