Explanation:
Box 1: No
Group2 is a Domain local group in the adatum.com domain.
Server2 is in the west.adatum.com.
A domain local group in one domain cannot be directly assigned resources in a server located in a subdomain. Domain local groups are primarily used to grant permissions to resources within the same domain where they are created. While they can contain members from other domains, their scope of permissions is limited to the domain they belong to.
Note:
Domain local groups are designed to manage access to resources within their own domain.
Box 2: Yes
Group3 is a Global group in the west.adatum.com.
Group1 is a Domain local group in contoso.com.
A global group from one domain can be added as a member to a domain local group in another domain, provided the domains trust each other. This is a common practice for managing permissions across domains Box 3: Yes Group4 is a Universal group in the contoso.com domain.
Server1 is in the adatum.com domain.
A Universal group in one domain can indeed be assigned permissions to resources in another domain, provided both domains are part of the same Active Directory forest. This is one of the key features of Universal groups, which allows for centralized management of permissions across multiple domains.
Reference:
https://blog.netwrix.com/2023/04/26/active-directory-nested-groups/
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security- groups