What is the difference between security groups and distribution groups in Active Directory, and what are the different group scopes?

Question

Accepted Answer

Active Directory uses groups to organize users and other objects so that permissions and email distribution can be managed efficiently. Understanding the difference between group types and scopes is essential for L2 technicians, because using the wrong group type or scope is a common source of access issues and confusion.

There are two types of groups in Active Directory: security groups and distribution groups. Security groups are used to assign permissions to shared resources. When you want to grant a set of users access to a file share, a printer, or an application, you add them to a security group and then assign the group the appropriate permissions on the resource. Security groups can also be used as email distribution lists if the organization uses Exchange or Microsoft 365. Distribution groups, on the other hand, are used exclusively for email distribution lists. They cannot be used to assign permissions to resources. If someone creates a distribution group and then tries to use it to grant access to a file share, it will not work.

Group scope determines where a group can be used and what objects it can contain. There are three scopes: Domain Local, Global, and Universal.

Domain Local groups are used to assign permissions to resources within the domain where the group exists. They can contain members from any domain in the forest, including users, Global groups, and Universal groups. The typical use case for a Domain Local group is to apply permissions directly to a resource. For example, you might create a Domain Local group called "FileServer-Finance-ReadWrite" and assign it read-write permissions on the finance department's file share.

Global groups can contain members only from the domain where the group is created. They can be used to assign permissions in any domain within the forest. Global groups are typically used to organize users by role or department. For example, a Global group called "Finance-Team" would contain all users in the finance department within that domain.

Universal groups can contain members from any domain in the forest and can be used to assign permissions in any domain in the forest. They are the most flexible but also the most resource-intensive, because Universal group membership is stored in the Global Catalog and replicated across all domain controllers that hold the Global Catalog role. Universal groups are best suited for organizations with multiple domains that need to grant access across domain boundaries.

The recommended best practice for group nesting follows the AGDLP model, which stands for Account, Global, Domain Local, Permission. You place user accounts into Global groups based on their role, then add those Global groups into Domain Local groups, and finally assign permissions to the Domain Local groups. This structure provides clean separation between who the users are, organized by role through Global groups, and what they can access, defined by Domain Local groups on specific resources. When a new employee joins the finance team, you simply add them to the Finance-Team Global group, and they automatically inherit access to every resource that the group has been granted.

For cross-domain scenarios, the model extends to AGUDLP, where Universal groups bridge the gap between Global groups in different domains and Domain Local groups on resources.

As an L2 technician, when handling access requests, always check whether the appropriate group already exists before creating a new one. Duplicate and overlapping groups create management headaches and make auditing difficult. Use Active Directory Users and Computers or PowerShell with the Get-ADGroup and Add-ADGroupMember cmdlets to manage group memberships efficiently.