Users and global groups from outside the local domain can be added to the local group only if they belong to a trusted domain. A local group can contain users and global groups, but it cannot contain other local groups. It is best to grant rights and permissions to local groups and to use the global group as the method of adding users to the local groups. Global groups are the best method for simultaneously adding many users to another domain. The necessary rights and permissions are provided by the local group to which the global groups are added.
Global groups are the most efficient way to add users to local groups.
Global groups can be added to local groups in the same domain or in trusting domains, or to computers running NT Workstation or NT Server as a member server in either the same domain or a trusting domain. There are built-in local and global user groups included in NT Server. If a user is granted only read access to a file, then when the user runs a program, that program cannot write to the file. The program, like the user, is granted read-only permission. A subject is the combination of the user's access token and the program that is acting on the user's behalf.