JSI Tip 7327. How do I change an Active Directory group type and/or scope from the command-line?

Using the Active Directory command-line tools, in a Windows 2000 domain, or Windows Server 2003 domain, you can change a group type and scope, from the command-line.

The syntax for change a group type is:

dsmod group group_DN -secgrp yes|no

where:

group_DN   is the distinguished name of the group, like any of the following:
                     "CN=accountants,CN=Users,DC=JSIINC,DC=ORG"
                     "CN=Accounts Payables,CN=Users,DC=JSIINC,DC=ORG"

yes | no   indicates if the group type is a security group (yes), or a distribution group (no).

NOTE: The domain functional level must be set to Windows 2000 Native or higher.

The syntax for changing the group scope is:

dsmod group group_DN -scope l|g|u

where:

group_DN   is the distinguished name of the group.

l | g | u  is the group scope where l is domain local, g is global, and u is universal. 

NOTE: The domain functional level must be set to Windows 2000 Native or higher.

NOTE: You can change the type and scope in a single command:

dsmod group group_DN -secgrp yes|no -scope l|g|u


NOTE: For additional options, dsmod group /?.