在ADSIEdit ，我们可以看到一个安全组的grouptype 属性值是 -2147483646 ， 而一个通用组的 grouptype 属性值是-2147483640 , 所以我们只要将所有属性值是 -2147483646的组改成-2147483640 就可以达到目的。 而批量更改这些属性最常用的工具就是 ADModify.

==============

Download ADModify tool from here:

ADModify.NET

http://admodify.codeplex.com/

A. Start ADModify

B. Click Modify Attributes

C. Domain List=Choose your Domain; Domain Controller=Choose your DC

D. Check only Groups; Check Advanced Features; Click Traverse Subcontainers

E. Click the Green Arrow and now highlight your Domain

F. Click Custom LDAP query.

Global Security Groups

(&(objectcategory=group)(grouptype:1.2.840.113556.1.4.803:=-2147483646))

G. Click Add to list and click OK

H. Select All and click next.

I. Click Custom Tab. Click Make a customized attribute modification

Attribute Name: groupType

Attribute Value: -2147483640

Click Ok. This will convert your Global Security Groups to Global Universal Groups.