Simple definition
A method of organizing groups and permissions in Active Directory.
Technical definition
AGDLP stands for Accounts → Global groups → Domain Local groups → Permissions. Users join global groups based on their roles; these groups are placed in domain local groups, which receive permissions on resources.
What is AGDLP used for?
Manage access rights consistently, reduce direct user permissions and simplify audits.
Practical example
Finance users belong to a global Finance group, which is added to a domain local group granted read access to a shared folder.
Common problems
- Rights given directly to users
- Misappointed groups
- Uncontrolled interlocking
Related terms
NTFS
To be noted: precise behaviors and commands may vary depending on the versions, products and architectures.