There are built-in groups for various administrative tasks. To assign custom permissions or resource permissions, create groups and add the appropriate users. Domain Local, Global, and Universal. Domain Local groups can contain accounts and groups from anywhere in the tree, but can only be applied to resources inside that domain. Global groups can contain only users and groups from inside the domain, but can be applied anywhere in the tree.
Universal groups are any to any, but also create a performance hit on the domain.
Other security measures are available. For a more complete discussion, go to Microsoft Technet Security Web site , or Securing Windows 2000 Server . Server are Windows 9x, Windows NT, and Windows 2000. Windows 95 and Windows NT require the installation of a Directory Services client. This setting can be turned on using Windows 2000 Policies or Registry.