Using the Active Directory command-line tools, in a Windows 2000 domain, or Windows Server 2003 domain, you can change a group type and scope, from the command-line.

The syntax for change a group type is:

dsmod group group_DN -secgrp yes|no

where:

<b>group_DN</b>   is the distinguished name of the group, like any of the following:
                     "CN=accountants,CN=Users,DC=JSIINC,DC=ORG"
                     "CN=Accounts Payables,CN=Users,DC=JSIINC,DC=ORG"

<b>yes | no</b>   indicates if the group type is a security group (<b>yes</b>), or a distribution group (<b>no</b>).

<b>NOTE:</b> The domain functional level must be set to Windows 2000 Native or higher.
The syntax for changing the group scope is:

dsmod group group_DN -scope l|g|u

where:

<b>group_DN</b>   is the distinguished name of the group.

<b>l | g | u</b>  is the <a href="/article/jsifaq/jsi-tip-2407-windows-2000-group-types-and-scope-usage-.aspx">group scope</a> where <b>l</b> is domain local, <b>g</b> is global, and <b>u</b> is universal.

<b>NOTE:</b> The domain functional level must be set to Windows 2000 Native or higher.

<b>NOTE:</b> You can change the type and scope in a single command:

<b>dsmod group group_DN -secgrp yes|no -scope l|g|u</b><p>

<b>NOTE:</b> For additional options, <b>dsmod group /?</b>.</p>