Announcement

Collapse
No announcement yet.

Active Directory can you use the same group as both a Distribution and Security group

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Active Directory can you use the same group as both a Distribution and Security group

    Id be grateful if some one could tell me if this was possible.

    And if so is it advisable?

    Thanks

    Adam

  • #2
    Re: Active Directory can you use the same group as both a Distribution and Security g

    Why do you think they provide two types? Personally I would say that it's either because you can't use one as both, or that it's ill-advised. Either way, your best bet is to use the design features as they were intended, and use group names to link Distribution and Security groups together; i.e. DL-Accounts-Dept and SG-Accounts-Dept. You can make SG-Accounts-Dept a MEMBER of DL-Accounts-Dept so that mails sent to the DL get to all the people in Accounts.
    Last edited by Stonelaughter; 11th July 2008, 14:34.


    Tom
    For my own and your protection, I do not provide support by private message under any circumstances. All such messages will be deleted and ignored.

    Anything you say will be misquoted and used against you

    Comment


    • #3
      Re: Active Directory can you use the same group as both a Distribution and Security g

      Somewhat, you can mail enable a Security group and you can use a Distribution group to apply permissions in some applications.

      You can't use a Distribution group for file shares and NTFS.

      Comment


      • #4
        Re: Active Directory can you use the same group as both a Distribution and Security g

        Originally posted by adam24 View Post
        Id be grateful if some one could tell me if this was possible.

        And if so is it advisable?

        Thanks

        Adam
        You can use security groups as distribution groups, but not vice-versa. I have to disagree a bit with Stonelaughter. The ability to use security groups as a distribution group was done by design. My take on it is that it's a well placed feature so that you don't have to sustain two identical groups; one for security and one for distribution when, in many cases, one group would be more elegant and utilitarian (not often do you see elegance and utilitarianism wedded!). It does not seem to be ill-advised if it is understood and used properly. Microsoft itself offers it as a viable solution in their materials (which in-and-of-itself doesn't prove beyond a doubt that it's okay... just that they'll support any problems that you have with it ).

        Of course, using nothing but security groups will increase the size of a user's security token, which can cause issues. Here's a decent (albeit simplified) thread on the topic. Don't worry about it if you've already got a logical security group structure that maps well to email distribution groups. (viz. you'd have those security groups anyway, so why not enable them for email as well?).

        For what it's worth, you can also convert a distribution group to a security group and vice-versa, but with some conditions involved.

        Maybe one of our resident Exchange Giants could weigh in on this topic?


        EDIT: Should this be in the Exchange forum?
        Last edited by Nonapeptide; 11th July 2008, 17:36.
        Wesley David
        LinkedIn | Careers 2.0
        -------------------------------
        Microsoft Certifications: MCSE 2003 | MCSA:Messaging 2003 | MCITP:EA, SA, EST | MCTS: a'plenty | MCDST
        Vendor Neutral Certifications: CWNA
        Blog: www.TheNubbyAdmin.com || Twitter: @Nonapeptide || GTalk, Reader and Google+: [email protected] || Skype: Wesley.Nonapeptide
        Goofy kitten avatar photo from Troy Snow: flickr.com/photos/troysnow/

        Comment


        • #5
          Re: Active Directory can you use the same group as both a Distribution and Security g

          Thanks for your help.

          I thought that but my boss needs some convinving?

          Comment


          • #6
            Re: Active Directory can you use the same group as both a Distribution and Security g

            I was asked to show an appearance in this question.

            Where possible I always create my groups as Security groups, so I can use them for both distribution and permissions. Obviously there are issues with the size of the security token as outlined, but with small sites that isn't usually an issue. I certainly haven't had to worry about it except when designing large sites.

            Simon.
            --
            Simon Butler
            Exchange MVP

            Blog: http://blog.sembee.co.uk/
            More Exchange Content: http://exchange.sembee.info/
            Exchange Resources List: http://exbpa.com/
            In the UK? Hire me: http://www.sembee.co.uk/

            Sembee is a registered trademark, used here with permission.

            Comment

            Working...
            X