Using groups in Active Directory

It is best practice to use groups to grant people or computer access to ressources. Here are the general rules to choose the right type of group:

Domain local is for the access of ressources.
Global group is for users of the same type or interests.

You create a domain local group to manage permissions on a domain ressource and you nest in it global groups to apply those permissions to the users or computers.

More information:

http://technet.microsoft.com/en-us/library/cc755692(WS.10).aspx

http://support.microsoft.com/kb/231273