In Windows® 2000, domains can operate in two different modes:
mixed or native. Groups behave differently depending on the domain
mode.
A mixed-mode domain supports only the following:
Global security groups can contain only user accounts.
Domain local security groups can contain other global groups
and user accounts.
Universal security groups cannot be created.
Universal distribution groups can be created.
Only distribution groups can be nested.
No conversion of scope or type is allowed.
A native-mode domain provides all the group features for Windows
2000:
Universal groups are available as security groups and
distribution groups.
Full group nesting is allowed.
Groups can be converted freely between security groups and
distribution groups. Global groups and domain local groups can be
converted to universal groups.
Before creating or converting groups that require native mode,
your application should check the operation mode of the domain.