Can I nest security groups (not mail-enabled) inside a Distribution List, to have members of the group receive mail to the list?

Question

I would like to manage my distribution lists indirectly, via security group. So that when I add a user to the appropriate security groups, they will automatically be members of the appropriate distribution groups.

Distribution Group Everyone ([email protected])
  Security Group A
    User 1 ([email protected])
    User 2 ([email protected])
  Security Group B
    User 3 ([email protected])
    User 4 ([email protected])

The security groups are not (and I would prefer that they remain not) mail enabled. Is this a viable setup? Is there something special I need to do to have this work? On the surface, it appears to be failing, so I suspect I must make the security groups mail enabled, but it frustrates me that there is not a better solution.

The problem is that I do not want users to get into the habit of emailing security groups directly, and if I mail-enable them then expanding the distribution group will result in them seeing the child groups, and possibly using them instead of the distribution list. Similar to an unpublished API, having this information visible may come back to haunt me at some future point.

Answer 1

No; distribution group membership checking is not recursive.

Exchange depends on the group expansion logic for nested membership, which means that all the groups down the chain must be mail-enabled.

It certainly would be nice if we could just dump security groups into distribution groups, especially if you've implemented role-based security, but the group expansion method fits a lot better with how a purely email implementation should behave.