How to Design Active Directory Security Groups with AGDLP
Applies to: Windows Server 2019, 2022 and 2025.
AGDLP separates people from resource ACLs: Accounts enter Global groups, Global groups enter Domain Local groups, and permissions are assigned to Domain Local groups.
Active Directory changes affect authentication across the environment. Use tested backups, separate privileged accounts and a maintenance plan. See networkmanager.info for managed Windows VPS services.
Prerequisites
- Identify the business role and resource permission.
- Assign a group owner.
- Use security groups for access.
- Avoid ACLs assigned directly to users.
Procedure
Step 1: Create the role group
Use Global scope.
New-ADGroup -Name 'GG-Finance-Users' -GroupScope Global -GroupCategory Security -Path 'OU=Groups,DC=corp,DC=example'Step 2: Create the resource group
Use Domain Local scope.
New-ADGroup -Name 'DL-Finance-Share-Modify' -GroupScope DomainLocal -GroupCategory Security -Path 'OU=Groups,DC=corp,DC=example'Step 3: Nest groups
Add Global to Domain Local.
Add-ADGroupMember -Identity 'DL-Finance-Share-Modify' -Members 'GG-Finance-Users'Step 4: Add approved users
Place accounts in the role group.
Add-ADGroupMember -Identity 'GG-Finance-Users' -Members 'amorgan'Step 5: Assign the ACL
Grant the resource permission to the Domain Local group.
Verification
Inspect both membership layers.
Get-ADGroupMember 'GG-Finance-Users'
Get-ADGroupMember 'DL-Finance-Share-Modify'Rollback and recovery
Remove users or nesting first. Remove ACL entries only after reviewing inherited and explicit permissions.
Operational notes
Multi-domain environments may use AGUDLP with Universal groups; use only the complexity required.
Official references
Explore managed Windows Server hosting from Netcloud24 Canada.
