Figure 1. Follow the AGLP Rule. You should use the AGLP rule when creating groups in your organization. This means that the only groups containing user or computer accounts are global groups. Global groups are placed into domain local groups for the assignation of permissions. This minimizes the number of groups in your domains as well as in the forest.