Which conversion is NOT permitted when managing group nesting?

When managing group nesting, converting a domain local group to a global group is not permitted. Domain local groups are specifically designed to assign permissions to resources within their own domain and can include global or universal groups as members, but they cannot be converted into global groups because global groups are limited to containing members from the same domain only. This limitation is a key aspect of the way permissions are structured within Active Directory, reflecting how these groups interact with different scopes and domains.

Global groups can be converted to universal groups, allowing them to include members from multiple domains, which enhances their usability across a forest. Universal groups can also typically include members from any domain, and domain local groups can encompass global groups as members.

Understanding the constraints within group nesting is essential for effective management of permissions and roles within Active Directory, making it clear why certain conversions, like domain local to global, are not allowed.