checking user group membership at logon RRS feed

  • Question

  • we know that when users logon to domain, the Global catalog server must check whether that user is member of any universal group or not ?  

    if i don't mistake, the user membership in universal Groups is checked via Global catalog server , but the user membership in domain local Groups is checked via normal Domain controllers.

    my question is :  why user membership in domain local groups can be checked via normal DCs but user membership in universal groups can't be checked via normal DCs ( and should be checked via Global catalog ? )

    ( we know like universal groups , domain local groups can have members from other domains in the forest and also external trusted forests )

    thanks in advance

    Friday, December 16, 2011 5:21 AM


All replies