skip to Main Content

Convert Global to Universal Security Group with PowerShell

We like to convert Global to Universal Security Group with PowerShell. Why with PowerShell? It’s because we have to convert more than a hundred groups. It will take hours of work if we are going to do it with Active Directory Users and Computers (ADUC). In this article, you will learn how to convert Global to Universal Security Group with PowerShell.

Active Directory group types

When creating a new group in the organization with ADUC, we have Group scope and Group type.

Convert Global to Universal Security Group with Powershell ADUC

Active Directory group scope

There are three group scopes that we can select:

  • Domain local groups: Used to assign permissions for access to resources.
  • Global groups: Used to organize users who share similar network access requirements.
  • Universal groups: Used to assign permissions to related resources in multiple domains.

Active Directory group type

There are two group types:

  • Security groups: Used to control access to resources. Security groups can also be used as email distribution lists.
  • Distribution groups: Can be used only for email distribution lists, or simple administrative groupings. Distribution groups cannot be used for access control because they are not security enabled.

Now that we have a bit of understanding about the group scope and group type, let’s start converting.

Convert Global to Universal Security group

We are going to get the information from one single group named Data. Run PowerShell as administrator.

Note: In ADUC it’s named Group scope and Group type. In PowerShell it’s named Group scope and Group category.
Change the group scope to Universal and the group type to Security. After that, we will check if it’s converted successfully.
Converting Global Distrubition group to Universal Security group went great. What if we have more than a hundred groups that we need to convert from Global to Universal Security group?

Bulk convert Global to Universal Security group

We have an Organizational Unit (OU) named Mailbox with all the groups that we like to convert to Universal Security group. Find the distinguished name in AD. We need to insert that in the PowerShell command.

Start Active Directory Users and Computers. Enable Advanced Features.

Convert Global to Universal Security Group with Powershell ADUC Advanced Features

Right-click the Organizational Unit with the groups that you like to convert. Click Properties.

Convert Global to Universal Security Group with Powershell OU Properties

Click the Attribute Editor tab. Find the attribute distinguishedName and copy its value.

Convert Global to Universal Security Group with Powershell Attribute Editor DistinguishedName

List all the groups in the OU Mailbox.

Create a temp folder on the C:\. Export the output to CSV and sort it on Name. This comes in handy if you want to send a list with the details. The name of the CSV will be Mailbox_Groups.csv.

Bulk convert all groups in OU Mailbox to group scope Universal. After that, check if the Group Scope is showing as Universal.

Do the same, but this time bulk convert all groups in OU Mailbox to group type Security. When done, check if the group type is showing as Security.

We can run both the above commands in one single command. This will bulk convert the groups in OU to group scope Universal and group type Security.

Conclusion

You learned how to convert Global to Universal Security Group with PowerShell. It’s just a couple of minutes work if we convert groups with PowerShell. We can convert one group only or we can do all the groups in bulk. Microsoft did write documentation regarding the Active Directory Security Groups. Did you enjoy this article? You may also like to read MSExchange ActiveSync 1023 warning. Don’t forget to follow us and share this article.

ALI TAJRAN

ALI TAJRAN

ALI TAJRAN is a passionate IT Architect, IT Consultant, and Microsoft Certified Trainer. He started Information Technology at a very young age, and his goal is to teach and inspire others. Read more »

This Post Has One Comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Back To Top