A. Universal groups are stored in the Global Catalog (GC), but does an additional database exist that stores only universal groups and is replicated among all GCs? Remember, GCs store a full copy of their local domain's partition and a subset of the domain database of every other domain in the forest (the only attributes stored are those defined in the partial attribute set). There is no additional database on top of the partial copies of every domain. Universal groups are created in a container within a specific domain, and their member attributes are replicated as part of the partial database stored on GC servers, whereas the member attributes of regular groups (e.g., global, local) aren't replicated as part of the partial database. Therefore, the partial database copy that's stored on every GC server knows the membership of every universal group from every domain in the forest. This functionality lets GCs store universal groups. The universal group membership is stored in the domain in which the universal group was created, and the partial copy of the domain is stored on every GC throughout the forest.
You can use the ADSI Edit tool to view this setup by performing these steps:
- Start ADSI Edit (Start, Run, adsiedit.msc).
- Right-click the root of ADSI Edit and select "Connect to".
- Enter a name for the connection (e.g., Partial Retail Domain), as the figure shows. In the Connection Point section, select "Select or type a Distinguished Name or Naming Context" and enter the distinguished name (DN) of the partition to view (e.g., dc=retail,dc=savilltech,dc=com). In the Computer section, enter the name of the GC server that isn't a domain controller (DC) for the partition you selected.
- Click Advanced.
- Under Protocol, select Global Catalog and click OK.
- Click OK at the main dialog box.
- Expand the new partition under ADSI Edit until you see the container that holds the universal group you want to view.
- Right-click the universal group and select Properties.
- Notice that the member attribute contains the users from all domains. If you look at a group that isn't a universal group, its member attribute will be empty.
