There are basically three groups scope type available In AD( Activation directory) that are:
Universal group
Global groups
Domain local groups
The main function of the active directory is that it is used to gather the various types of object together for the ease of the administration. The activation directory basically offers the potential risks in the nesting security.
Each these above mention groups define the possibility of the members in a groups and the permission of the groups are applied within the group of domain.
Nope. You're on your own to find them and fix them. This why testing is so important, otherwise they won't show up until the customer finds them and that's embarrasing.
