{"id":67333,"date":"2006-05-12T09:38:00","date_gmt":"2006-05-12T09:38:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2006\/05\/12\/how-can-i-convert-a-global-security-group-to-a-universal-security-group\/"},"modified":"2006-05-12T09:38:00","modified_gmt":"2006-05-12T09:38:00","slug":"how-can-i-convert-a-global-security-group-to-a-universal-security-group","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/how-can-i-convert-a-global-security-group-to-a-universal-security-group\/","title":{"rendered":"How Can I Convert a Global Security Group to a Universal Security Group?"},"content":{"rendered":"

\"Hey, \n

Hey, Scripting Guy! How can I convert a global security group to a universal security group?

— BB<\/P>\"Spacer\"\"Hey,\"Script<\/A> \n

Hey, BB. We have to tell you the truth, we were pretty excited when we first read your email. Convert a global security group to a universal security group? That sounded like a mad scientist sort of thing, and we had visions of setting up a huge lab with all sorts of cool machines and beakers of chemicals, and then one of us would throw a switch and a great bolt of lighting would surge through the room. Everything would be quiet, and then, through the smoke, we\u2019d see our little security group beginning to twitch. \u201cHeaven help us,\u201d we\u2019d say. \u201cWe\u2019ve created a universal security group!\u201d<\/P>\n

Cool, huh? In fact, we had already written the screenplay and signed a contract for a series of action figures before we found out that we didn\u2019t actually need a mad scientist\u2019s laboratory to convert a global group to a universal group. Instead, all we needed was this:<\/P>

Const ADS_GROUP_TYPE_UNIVERSAL_GROUP = &H8\nConst ADS_GROUP_TYPE_SECURITY_ENABLED = &H80000000<\/p>\n
Set objGroup = GetObject _\n    (“LDAP:\/\/cn=Managers,ou=Finance,dc=fabrikam,dc=com”) <\/p>\n
objGroup.Put “groupType”, ADS_GROUP_TYPE_UNIVERSAL_GROUP OR ADS_GROUP_TYPE_SECURITY_ENABLED\nobjGroup.SetInfo\n<\/PRE>\n
Hey, if you think you\u2019re disappointed imagine how we<\/I> feel. As it turns out, though, each Active Directory group has a property named groupType<\/B> that, well, determines the group type. GroupType is a bitmask attribute that can be made up of as many as two different values. Value 1 determines whether the group is a security group or a distribution group. (What\u2019s the difference? Security groups can be given access to resources; distribution groups can\u2019t.) Value 2, meanwhile, determines the type of security group or the type of distribution group. Either security groups or distribution groups can be one of the following:<\/P>\n\n\n\n\n\n
\u2022<\/TD>\n\n
Global groups<\/B>, in which all the users must come from the same domain.<\/P><\/TD><\/TR>\n
\u2022<\/TD>\n\n
Domain local groups<\/B>, in which members can be drawn from any domain in the forest, but permissions can only be granted to the local domain (that is, the domain where the group account resides).<\/P><\/TD><\/TR>\n
\u2022<\/TD>\n\n
Universal groups<\/B>, in which members can be drawn from any domain in the forest and be granted permissions anywhere in the forest.<\/P><\/TD><\/TR><\/TBODY><\/TABLE>\n
Fascinating, isn\u2019t it?<\/P>\n
By the way, that\u2019s a good question: how can<\/I> a single attribute consist of more than one value? That\u2019s bitmask attributes for you. We won\u2019t discuss bitmasks in any detail today; if you\u2019d like a more thorough discussion, check out this Scripting Guys webcast<\/B><\/A>. For now, think of the groupType attribute as being like a series of switches. Suppose the switch for security group is on, the switch for global group is on, and all the other switches are off? In that case, we\u2019d have a global security group. That implies that we can convert a group to a universal security group simply by ensuring that only the security group and the universal group switches are on. And that\u2019s exactly what our script does. <\/P>\n\n<\/THEAD>\n\n\n
\n
Note<\/B>. This is probably a good time to point out that Active Directory imposes a few limitations when it comes to converting from one group to another. For example, you can\u2019t convert a global group to a domain local group; Active Directory won\u2019t allow that. Likewise, you can only convert groups if your domain is in native mode. Groups in a mixed-mode domain can\u2019t be converted. Check the Active Directory documentation<\/B><\/A> for more information.<\/P><\/TD><\/TR><\/TBODY><\/TABLE>\n
<\/DIV>\n
These \u201cswitches\u201d are actually a series of constants and their corresponding values. In fact, they\u2019re actually this<\/I> series of constants and their corresponding values:<\/P>\n\n<\/THEAD>\n\n\n\n\n\n\n
\n
Group Type<\/B><\/P><\/TD>\n
\n
Constant<\/B><\/P><\/TD>\n
\n
Value<\/B><\/P><\/TD><\/TR>\n
\n
Global group<\/P><\/TD>\n
\n
ADS_GROUP_TYPE_GLOBAL_GROUP<\/P><\/TD>\n
\n
&H2<\/P><\/TD><\/TR>\n
\n
Domain local group<\/P><\/TD>\n
\n
ADS_GROUP_TYPE_DOMAIN_LOCAL_GROUP<\/P><\/TD>\n
\n
&H4<\/P><\/TD><\/TR>\n
\n
Universal group<\/P><\/TD>\n
\n
ADS_GROUP_TYPE_UNIVERSAL_GROUP<\/P><\/TD>\n
\n
&H8<\/P><\/TD><\/TR>\n
\n
Security group<\/P><\/TD>\n
\n
ADS_GROUP_TYPE_SECURITY_ENABLED<\/P><\/TD>\n
\n
&H80000000<\/P><\/TD><\/TR><\/TBODY><\/TABLE>\n
<\/DIV>\n
To explain how you can set these switches, let\u2019s go back to our script. We start out by defining a pair of constants: ADS_GROUP_TYPE_UNIVERSAL_GROUP and ADS_GROUP_TYPE_SECURITY_ENABLED. Why these two constants? That\u2019s easy: we want to create a universal security group, which means we need to flip the switches for universal group and for security group. If we wanted to create a universal distribution<\/I> group then we\u2019d only need to flip one switch and define one constant: ADS_GROUP_TYPE_UNIVERSAL_GROUP. (Because, of course, the security group switch needs to be off<\/I> in order for us to have a distribution group.)<\/P>\n
After binding to the group account in Active Directory (for this sample script that\u2019s the Managers group in the Finance OU) we encounter this line of code:<\/P>
objGroup.Put “groupType”, ADS_GROUP_TYPE_UNIVERSAL_GROUP OR ADS_GROUP_TYPE_SECURITY_ENABLED\n<\/PRE>\n
This is where we set the value of the groupType attribute. To do that, we pass our two constants as parameters, joining the two with the OR operator. Don\u2019t worry too much about OR; in this case we can read it as though it was the word and<\/I>: \u201cSet the group type to a universal group and<\/I> a security group.\u201d If we wanted to convert the group to a global security group we would simply need to define the constant ADS_GROUP_TYPE_GLOBAL_GROUP and then use this<\/I> code:<\/P>
objGroup.Put “groupType”, ADS_GROUP_TYPE_GLOBAL_GROUP OR ADS_GROUP_TYPE_SECURITY_ENABLED\n<\/PRE>\n
Only the switch values we pass to groupType will be flipped on; any other switches will be turned off. And, yes, if you pass a nonsensical request – for example, passing all the possible constants – the script will simply fail. Active Directory won\u2019t allow you to create, say a domain local universal security distribution group. <\/P>\n
And for good reason.<\/P>\n
Make sense? To make it a universal distribution<\/I> group we\u2019d pass just one parameter, ADS_GROUP_TYPE_UNIVERSAL_GROUP:<\/P>
objGroup.Put “groupType”, ADS_GROUP_TYPE_UNIVERSAL_GROUP\n<\/PRE>\n
Again, that\u2019s because we don\u2019t enable the security group switch (ADS_GROUP_TYPE_SECURITY_ENABLED) for distribution groups.<\/P>\n
At any rate, after setting the groupType all we have to do is call the SetInfo<\/B> method and the group will change from a global security group to a universal security group, just like that.<\/P>\n
And, no, sorry: the change is made without any bolts of lightning, bursting beakers of chemicals, or other special effects. Hmmm, maybe that\u2019s why they turned down our proposal to use a scripting theme for the latest Mission:Impossible<\/I> movie. <\/P>\n
Oh, well. Wonder if we\u2019re too late to propose a plot for X-Men 3<\/I> \u2026.<\/P><\/p>\n","protected":false},"excerpt":{"rendered":"
Hey, Scripting Guy! How can I convert a global security group to a universal security group?— BB Hey, BB. We have to tell you the truth, we were pretty excited when we first read your email. Convert a global security group to a universal security group? That sounded like a mad scientist sort of thing, […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[7,44,3,5],"class_list":["post-67333","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-active-directory","tag-groups","tag-scripting-guy","tag-vbscript"],"acf":[],"blog_post_summary":"
Hey, Scripting Guy! How can I convert a global security group to a universal security group?— BB Hey, BB. We have to tell you the truth, we were pretty excited when we first read your email. Convert a global security group to a universal security group? That sounded like a mad scientist sort of thing, […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/67333","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=67333"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/67333\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=67333"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=67333"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=67333"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}