What are the implications of converting all my groups to universal groups?

Solution 1:

If you only have a single domain and all of your domain controllers are global catalogs, there isn't much impact. Best practice is all domain controllers should be GC's.

In large forests with multiple domains, it can be advantageous to limit what groups are universal. This is due to the member attribute of universal groups are replicated to the global catalog. Consider a scenario with a large forest, multiple domains, a large number of universal groups with a high member count, all of those members would exist in the global catalog and be replicated to every domain controller/domain. This replication and the resulting increase in the database size could be minimized by creating a global group in each domain, and having a single universal group where the members are the global groups.

This is less of an issue today than in the past. Prior to Windows Server 2003, all group members were replicated ever time the group membership was updated. It wasn't unusual for large universal groups to be in a constant state of replication. Now only the added/removed members are replicated.

If your AD environment and groups are very old (created prior to Windows 2003), it's possible they may not yet support the new Linked Value Replication capability to replicate only the added/removed members, but that can be fixed by removing/re-adding the members. You can confirm this by running repadmin /showobjmeta for the group. If a group member appears as "LEGACY" instead of "PRESENT", it should be fixed before converting to a universal group.

Solution 2:

Another way to think it would be to create dynamic distribution group if you don't want to change your groups.

Dynamic distribution groups are mail-enabled Active Directory group objects that are created to expedite the mass sending of email messages and other information within a Microsoft Exchange organization.

Unlike regular distribution groups that contain a defined set of members, the membership list for dynamic distribution groups is calculated each time a message is sent to the group, based on the filters and conditions that you define. When an email message is sent to a dynamic distribution group, it’s delivered to all recipients in the organization that match the criteria defined for that group.

That way if in AD you type for a User X an attribute, like, show there for the Office, then Exchange do the rest.. (image took from there)

You add the attribute;

You create the group;

New-DynamicDistributionGroup -Name "Users in Example Office Name" -OrganizationalUnit "domain.net\users" -RecipientFilter { ((RecipientType -eq 'UserMailbox') –and (Office -eq 'Users in example office name')) }

Exchange do the rest, as long you keep your attribute up to date when a user quit for another job/office.