An Active Directory Container that can contain:
Groups are regarded as Security Principals.
Fundamental Characteristics
Groups in Active Directory (AD) have two fundamental characteristics, that must be selected when a group is created: type and scope.
Type
There are two main types: security and distribution.
Security Groups
Used to simplify management of permissions and and rights, by grouping Users and managing this group instead of every individual user in the group.
All users assigned to the group will inherit the the permissions assigned to the group.
Distribution Groups
Used by email applications like Microsoft Exchange to distribute messages to group members.
Such groups function like a mailing list and cannot be assigned permissions.
Scope
There are three scopes: Domain Local, Global, and Universal.
Groups can change scope under the following restrictions:
- A Global Group can only be converted to a Universal Group if it is NOT part of another Global Group.
- A Domain Local Group can only be converted to a Universal Group if the Domain Local Group does NOT contain any other Domain Local Groups as members.
- A Universal Group can be converted to a Domain Local Group without any restrictions.
- A Universal Group can only be converted to a Global Group if it does NOT contain any other Universal Groups as members.
Domain Local Groups
Used to manage permissions to Domain resources in the domain the group was created.
These groups cannot be used in other domains but they can contain users from other domains.
Domain local groups can be nested within other domain local groups but not within global groups.
Global Groups
Can be used to grant access to resources in other Domains.
A global group can only contain users from the domain it was created.
They can be added to both other global groups and local groups.
Universal Groups
Can be used to grant access to resources across different Domains but within the same Forest.
They can contain users from all domains.
Universal groups live in the Global Catalogue (GC), and any change to them (add/remove members) triggers Forest-wide Replication.
It is recommended that administrators maintain other groups (such as global groups) as members of universal groups because global group membership within universal groups is less likely to change than individual user membership in global groups. Replication is only triggered at the individual domain level when a user is removed from a global group. If individual users and computers (instead of global groups) are maintained within universal groups, it will trigger forest-wide replication each time a change is made, causing more network overhead.
Important Attributes
cn: The Common-Name is the name of the group in Active Directory Domain Services.member: Which user, group, and contact objects are members of the group.groupType: An integer that specifies the group type and scope.memberOf: A listing of any groups that contain the group as a member (nested group membership).objectSid: This is the Security Identifier (SID) of the group, which is the unique value used to identify the group as a Security Principal.
Security Risk
Since a Domain Local Group can be member of another Domain Local Group in the same domain, it can happen that a user inherits privileges not assigned directly to the user or its group, but a group that their group is a member of.
This can lead to unintended privileges that are hard to uncover without a thorough assessment of the Domain. For such cases Bloodhound is useful for uncovering such inherited privileges through nested groups.