Where do SharePoint Groups live?

Question

More specifically, if I have a site collection I can create groups while in the root site. I can also create groups while in the various subsites. But from browsing the available groups in the subsites, regardless of whether or not the subsite is inheriting permissions or has unique permissions, I get the feeling that any changes to the groups in the subsite will impact the rest of the collection.

So are all SharePoint groups attached to the site collection? The root site of the collection? or to the individual sites within the collection?

Edit:

I am asking the question because I need to map a SharePoint group name within a K2 Workflow. For reasons I do not fully understand, the K2 Workflow's SharePoint Group name resolution requires not only the K2 Security Label, but also a relevant site name prior to the group name. When using the K2 SmartObject for listing groups on the site, all the groups come back with names like this:

root site\group 1
root site\group 2
root site\group 3
subsite A\group 1
subsite A\group 2
subsite B\group 2
subsite B\group 3

The K2 SmartObject list shows the groups in many of the collection's sites. However, the groups do not appear in all sites. I created two nested sub-sites under an existing sub-site, then broke inheritance and created a new group in both sites. The new groups show up, prefaced by the site name for the root site and many of the first level sub-sites. However, I did not see them with their own site names. What rules does SharePoint follow when assigning names to groups?

Answer 1

Internally, all users resides inside a special list known as "user information list" at the root site (/) of any SharePoint site collection. This list can be accessed through

http://yoursitecollection/_catalogs/users/simple.aspx

Groups are virtual collections of users against this list maintained inside the SharePoint Content Database and have different acls mapped against each securable objects . A securable object can be a site,list or item.

All groups can be only managed from the root site , and they can be used across anywhere in the entire site collection.

Essentially, you can create a group , add users to it , give permissions at a site level however to use them in subsite by breaking inheritance only means mapping them to securable object towards any depth of the subsite or items from the root site. This only makes a reference of the group residing in the top site to its absolute destination.

Edit: Please refer this link for more details on this topic.

Answer 2

SharePoint groups live at the Site Collection level (SPSite) but are generally exposed in the Group Quick Launch of the site where they are created. The Group Quick Launch can be edited for each site and subsite within a site collection. Site Actions->Site Settings->People and Groups, then click the Groups heading in the lefthand navigation, and then in the main panel, Settings->Edit Group Quick Launch.

Answer 3

So are all SharePoint groups attached to the site collection?

As far as I know they do reside in root site collection, and when you create a sub-site by default it inherits permissions from parent web.

or to the individual sites within the collection?

Only when you break inheritance and assign custom permissions, you can always create custom groups with custom permissions levels too.

Security planning for sites and content (SharePoint Server 2010)

SharePoint groups live or stored in content database where your site collection is residing.

Check this MSDN article about groups out.

You can always break inheritance for sub site and then assign custom permissions to sub site.