To assign custom permissions or resource permissions, create groups and add the appropriate users. Global groups can be assigned permissions anywhere in the domain. Global groups can only contain users. Local groups can only be assigned permissions on the local machine. Since Domain Controllers share account information, Local groups are identical on all Domain Controllers.
Local groups can contain Global groups and users.
For maximum flexibility, users should be added to Global groups in the domain by category, then these Global groups should be added to Local groups on the same server as is sharing a resource. Resource permissions should then be granted to these Local groups. Assigning local resource access directly to domain Global groups also works, however. This allows setting password strengths and lockouts. Other security measures are available.