Microsoft's model is:
user 1,2,3,4 > Global Security Group > Domain Local Group > $resource
I noticed someone put in domain\Users (which is a built-in group), instead of using Domain Users. I'm skeptical to think that this works because of security group nesting... Domain Users is a member of domain\Users (built-in) but I have never saw someone use that built-in group before....
0_1461775381653_users.png