Read more: Distribution group or mail enabled security group? Distribution groups are designed to be used for e-mail specifically and cannot be granted Windows permissions.The terms “distribution groups” and “distribution lists” tend to be used interchangeably, particularly if you work with Microsoft Exchange Server administrators. These are known as security-enabled distribution groups.ĭistribution groups are designed to combine users together so that you can send e-mails (via Microsoft Exchange Server) collectively to a group rather than individually to each user in the group.

Security groups can also be used as a distribution group in Exchange. Used with care, security groups provide an efficient way to assign access to resources on your network. With a little work, we dug out enough info for this cheat sheet on Active Directory groups: We were demonstrating how to manage the creation and automation of Active Directory security groups and distribution lists before we realized that we had no idea what the differences were between the types of Active Directory groups: security and distribution groups, and the group scopes: universal groups (UG), global groups (GG), and domain local groups (DLG).

In Windows, there are 7 types of groups: two domain group types with three scopes in each and a local security group. The administrator manages the group as a single object. The group can include users, computers, other groups, and other AD objects. Using groups can simplify administration by assigning a set of permissions to a group once, rather than assigning permissions and rights to each group member individually.Įxploring Types of Active Directory GroupsĪs we discussed above, Active Directory groups are a collection of Active Directory objects. Objects that belong to a particular group are referred to as group members. Within Active Directory, a group is a method for collecting users, contacts, computers, and even other groups’ objects so that you can manage the objects in the group as a single unit. You can also create your own groups and assign those groups various levels of access and permissions. Active Directory has several built-in groups that you can use to assign users or computers to, so they have the permissions they need to get their jobs done. Many other programs can tie into Active Directory to manage user accounts and other objects as well. Active Directory enables administrators to manage all objects and services from one centralized location rather than having to go from computer to computer to get things done.

Active directory security group naming