You should limit membership in universal groups to global groups. The recommended strategy is to use Global and Domain Local groups to control permission and rights. The DACL for an object specifies the access permissions, or who has access to the object and the specific actions that a user can perform on the object. A User s effective permissions are a combination of the user and group permission given to the object. You can allow or deny permissions.
Denied permissions take precedence.
You can specify standard or special permissions. There are a large number of special permissions and some objects have additional standard permissions. 27 permissions that you can grant or deny. Permission inheritance is the new feature of Windows 2000 that minimizes the number of times that you need to specify the permissions for objects. Shaded check boxes indicate inherited permissions.