Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Quick sanity check - If I nest an Active Directory distribution group within an Active Directory Security group, will permissions assigned to the AD Security group cascade to the members of the distribution group nested within the security group, or do I need to convert the distribution group to a mail-enabled security group?

The context (if it helps) is that another team has given me a security group to use to give permissions to their team, and after granting permissions to that security group, nobody has permissions. Looking at the membership of that security group, it is a distribution group containing their people. I assume that is why it is not working, but just wanted a confirmation before I push back.

share|improve this question
up vote 3 down vote accepted

Distribution groups are not security principals if I remember correctly, and therefore cannot propagate secutiry permissions to their members. Pretty sure you need a mail-enabled security group.

share|improve this answer

Short answer - no but there are limitations. I would recommend just mail enabling the security group rather than nesting, but that would be based of complexity of the members/groups.

If this is for public folders forget it, they must be distribution groups as far as I am aware.

share|improve this answer

One of our System Analysts found that Microsoft really wants distribution groups inside distribution groups and security groups inside security groups. We are using Exchange 2010 with some groups being managed by a user. When they were security groups the user had no way to change the group membership through Outlook Web Access and only by switching them to distribution groups where we able to fix this.

The end result is that we have to have duplicate groups in some cases (when the group was needed to be used both to prevent users from access files and when they wanted a distribution group).

share|improve this answer
SP1 for Exchange 2010 enables end users to manage security groups through OWA. – Brian Desmond Feb 21 '11 at 1:49
Use care here.. For many a user will ask for a mail enabled security group so they can bypass the security fulfillment teams. That is, Bob in accounting will ask for a mail enabled security group he can manage, so he can add/remove users without needing your helpdesk or admin staff to do it. If your a SOX shop however, this violates the "least Privileged" requirement. – user324508 Nov 27 '15 at 21:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.