Local Groups are created on workstations and only apply to the workstation. Global Groups are created on Domain Controllers and apply to all computers in the domain. Changing permissions of a group changes the permissions of everybody in the group. Share permissions apply to who can access a shared directory and how. File permissions determine who and how files are shared.
Administrators always have full access to all resources.
User has combined permissions of all groups. No Access Permission overrides all others. NT chooses the most restrictive permission in a conflict. User Rights controls activities users can engage in. System Policies set through the System Policy Editor.