What controls which objects a group can contain?

Group Policy

In the Active Directory are abailable several group scopes. The groups scope controls which objects the group can contain, limiting the objects to the same domain or permitting objects from remote domains, and controls the location in the domain or forest there the group can be used.