The Green signifies resource domain 3. Security is simplified by pulling groups from the master domain into the resource domain. Now we get into global and local groups. The global groups can span domains but local groups cannot. The key here is knowing how to utilize both sets of groups.
Global groups go into Local groups, in one or more domains.
Resources are secured by Local groups. These are not hard and fast rules, but they are the recommended method because it decreases administration over time. So, let's go through an example. So, JDoe can add and read files in the AccountingStuff directory on that server in Resource Domain 2 even though he is not in any group on that local domain. The reason for the multiple domains is to logically group the computers together.