Group Members - Enterprise OU structure mapping

i don't understand default group members , permissions. tested ad creating dummy group (dummygrp)and account(dummy1) experiment gpos. don't know why it's not allowing me add "nt authentication" (the security principal) or “users” group via “members”/ “member of” tab in dummygrp. allow me add “domain users” builtin group. system added builtin “users” group default builtin “domain users” group. “users” group has absolutely no members within - totally empty.

this i'm lost. don't understand why it's prudent add groups others, scheme /rationale behind proper group inclusion. according experts, adding wrong group(s) object can ruin network's resources. in case, i'm trying organize small company 7 departments. ideally want each department in respective group delegate permissions/gpos. groups must add in order work normally?

i want implement features gpo security filtering. documentation on ms website defines security principals, descriptors, aces, etc. checked the default “domain users” group. has “administrator” , “krbtgt(with down arrow).” checked technet , few other websites. take @ links below:

https://technet.microsoft.com/en-us/library/cc785098%28v=ws.10%29.aspx

http://ss64.com/nt/syntax-security_groups.html

you can @ diagram on ss64.com. on machine (winserver2012) “administrators” group in users folder holds following: administrators, domain admins, domain users, enterprise admins, group policy creator owners, , schema admins. looks weird disaster waiting happen. must add function real corporate enterprise environment?

>i don't know why it's not allowing me add nt authority (the security
>principal) or “users” group via “members”/ “member of” pane in dummygrp
 
nt authority refers windows operating system itself, not user or group. users builtin group, default, builtin groups cannot added other groups.
 
>i'm trying organize small company 7 departments. ideally want each department in respective group
>to delegate permissions/gpos. groups must add in order work normally?
 
can create separate groups each departments, , delegate permissions them or use them in gpo security filtering.
 
i'm not sure whether have cleared away doubts, take @ technet article better understanding of groups in active directory:
 
https://technet.microsoft.com/en-us/library/dd861330.aspx
 
let me know if have further questions.
 

regards,

ethan hua

---

please remember mark replies answers if help, , unmark answers if provide no help. if have feedback technet support, contact tnmff@microsoft.com

Windows Server  >  Windows Server 2012 General