<p>I have a SQL Server 2000, C# &amp; ASP.net web app.  We want to control access to it by using Active Directory groups.  I can get authentication to work if the group I put in is a 'Global' but not if the group is 'Universal'.  </p>

<p>How can I make this work with 'Universal' groups an well?
Here's my authorization block:</p>

<pre><code>  &lt;authorization&gt;
  &lt;allow roles="domain\Group Name Here"/&gt;
  &lt;allow roles="domain\Group Name Here2"/&gt;
  &lt;allow roles="domain\Group Name Here3"/&gt;
  &lt;deny users="*"/&gt;
  &lt;/authorization&gt;
</code></pre>

Depending on your Active Directory topology, you might have to wait for the Universal Group membership to replicate around to all the Domain Controllers.  Active Directory recommends the following though:
Create a Global group for each domain, e.g., "Domain A Authorized Users", "Domain B Authorized Users"
Put the users you want from Domain A in the "Domain A Authorized Users" group, etc
Create a Universal group in the root domain "All Authorized Users"
Put the Global groups in the Universal group
Secure the resource using the Universal group: <allow roles="root domain\All Authorized Users/>
Wait for replication
One advantage of this scheme is that when you add a new user to one of the Global groups, you won't have to wait for GC replication.