What's the best way of assigning permissions to users and groups in Windows 2000 and later?

A. In general, the best way to assign permissions is by performing the following steps:

One advantage of establishing this hierarchy is that universal group memberships are unlikely to change because they contain only global groups. A good way to remember this hierarchy is to use the following mnemonic device:

All Good Users Do Love Permissions

Accounts are placed in global groups, Global groups are placed in universal groups, Universal groups are placed in domain local groups, and Domain Local groups are assigned Permissions.