Groups in Active Directory

Active Directory groups extend the general concepts from Users and groups with two extra dimensions: type and scope.

Group type: Security vs. Distribution

Security groups can be granted permissions (used in access control lists) and can also receive email if mail-enabled.
Distribution groups are for email distribution lists only — they can't be used in permissions.

If you're checking access, you almost always care about security groups specifically.

Group scope

Scope	Can contain members from	Typically used for
Domain Local	Any domain in the forest	Granting access to resources in the local domain
Global	Only the local domain	Organizing users who share a role, within one domain
Universal	Any domain in the forest	Multi-domain roles, replicated forest-wide

For a single-domain deployment (the common case), the distinction rarely matters day-to-day — most groups end up Global or Domain Local by default.

Nested membership and memberOf

Active Directory automatically resolves nested group membership into a user's memberOf attribute, up to its recursion depth limit. If Engineering is a member of AllStaff, a member of Engineering shows AllStaff in their memberOf results too, with no extra queries needed on your side.

dc=com
- dc=example
  - dc=corp
    - ou=Groups
      - cn=AllStaff
      - cn=Engineering
    - ou=Users
      - cn=Jane Doe

This is one of the more convenient parts of AD compared to directories without a maintained reverse-membership overlay — see the general discussion in Users and groups.

Well-known built-in groups

A few groups exist in every AD domain and are worth recognizing:

Domain Admins — full administrative control of the domain. Membership should be tightly restricted and monitored.
Domain Users — every user account is a member by default.
Enterprise Admins — full control across the entire forest (only present in the forest root domain).

Checking membership from Node.js

const groups = await getUserGroups(client, userDn); // from Groups with ldapjs
const isAdmin = groups.some((dn) => dn.startsWith("CN=Domain Admins,"));

See Groups with ldapjs for the full getUserGroups implementation.

What's next

Continue to Common attributes for a consolidated reference table.