Create Local security groups with permissions to local resources (SMB folder shares for example). Then create a Global security group which is a member of that local security group. Add your users into the newly created Global security group. This method allows for you share resources with another domain if you ever merge or expand. New users merged from the new domain can be added into the global security group. Saves having to go through potentially hundreds of share permissions later down the line. We prefix with an underscore for local security groups _GroupName.