Working with Security and Distribution Groups

In general, groups are used to grant permissions to similar types of users, to make contact of multiple users easier, and to simplify administration. For example, instead of having to enter 10 email addresses in the message header, a message can be sent to one group email, which is then fanned out to all 10 email addresses in the group.

Group Types and Scopes

Microsoft Windows 2003 defines different group types, with each group having a unique scope. The three group types that can be created within Active Directory are

• Security Groups Groups used to secure access to network resources via permissions; they can also be used to distribute email messages.

• Distribution Groups Groups that can be used only to distribute email; they have a fixed membership that can't be used to access network resources.

• Query-Based Distribution Groups (QBDGs) These groups are new to Exchange 2003. Their membership is based on a LDAP (Lightweight Distribution Access Protocol) query that can be used only to distribute email. Using LDAP, a member list is created whenever messages are sent to a group.

So what is the main difference between a security and a distribution group? Although both groups can have an email address associated with them, a distribution group cannot be used to set security settings. For example, you cannot create a distribution group called Project Team and then assign security rights to that group.

When you are working with distribution and security groups, there are many things that can or cannot be done, depending on the group's scope and the mode that Windows Server is running. The are three types of scopesglobal, domain local, and universaland two type of modes, mixed or native. See Table 3.1 for a summary of what can and cannot be done according to the network operating mode.

Table 3.1. Understanding Group Scope, Group Membership, and Windows Operating Mode

Scope	Group Membership	Windows Mixed Mode	Windows Native Mode
Domain Local	Permission assigned only in the same domain; can be put into other domain local groups.	Global groups and accounts from any domain.	Global groups, accounts, and universal groups from any domain. Domain local groups can be only from the same domain.
Global	Permissions assigned in any domain; can be put into other groups.	Can contain accounts only from the same domain.	Global groups and accounts only from the same domain.
Universal	Can be assigned permissions in any domain and can be put into other groups.	Not available in mixed mode domains.	Regardless of scope, can contain accounts or groups from any domain.

Creating Security or Distribution Groups

Using the following steps, administrators can create security or distribution groups:

1.	Open Active Directory User and Computers. Right-click in the container where you want to create a new group, select New, and then select Group.
2.	As shown in Figure 3.3, the New Object-Group dialog box will appear. In the Group Name field, type up to a 64 character name for the new group. The first 20 characters will be automatically inserted for the Pre-Windows 2000 group name and must be unique for the domain. If needed, you can type a unique name into this field. Figure 3.3. Creating security and distribution groups through Active Directory Users and Computers.
3.	Select a group type of either Domain local, global, or universal (available only in native mode). The recommended scope type is universal; if you are unsure about which scope to use, choose universal.
4.	Select Security or Distribution for your group type and click Next.
5.	If the Exchange is set up properly, the Create an Exchange Email Address option will be available. Make sure that the box is checked and that the correct Alias name for the email address is displayed. (By default, the alias name is set to the group name.) If an Exchange email address isn't needed, uncheck this option.
6.	Click Next and then click Finish, creating the group. If creation of an email address was selected, SMTP and X.400 email addresses will be automatically created.

After the group is created, administrators can change additional group properties, such as adding members to the group, setting message size-restriction limits, adding or removing email addresses, or limiting which users can send messages to the group.

Creating Query-Based Distribution Groups

Query-based distribution groups do not have a scope that is domain local, global, or universal. Their membership can contain users and groups from other domains or forests or members of the local domain. Their scope is determined by the container associated with the group when it is created. For example, if the container associated with the group is pandoranetworks.com, the query filter is applied to all recipients in the domain. If a filter is applied to a specific organization unit (OU) in a domain, the filter applies to all recipients in the container and those in any containers below.

Note

Query-based distribution groups are available only when Exchange is running in native mode and all servers in the enterprise are at least running Exchange 2000 SP3 or later. An administrator can check which mode Exchange is in by opening ESM, clicking the Exchange Organization, and then selecting Properties. Review the Operation Mode section to see what mode your Exchange server is currently running in.

The beauty of query-based distribution groups is that less time is spent managing group membership. In most organizations, people move around the company to different roles, departments, or eventually leave the company. Instead of specifying static user memberships, query-based distribution groups minimize the amount of time spent adding or removing users from groups by allowing LDAP queries to dynamically build membership in the distribution group. The group membership is created on-the-fly. An LDAP query is run every time an email is sent to this dynamic distribution list. Thus, using query-based distribution groups can dramatically reduce the administrative costs.

Caution

Query-based distribution groups work best when the member list results are 25 to 30 members or fewer. Potential member lists in the hundreds or thousands will put severe processing demands on a global catalog server because of the inefficient nature of the LDAP queries. If query-based distribution groups have potential to grow to larger numbers, switching the processing tasks from the global catalog server to a dedicated LDAP expansion server will help in resolving large distribution lists more quickly.

Because groups are used to manage email distribution and permissions, remember to create groups that will contain similar types of users. Typically, administrators create groups for users who work in the same departments and need access to similar network resources, users who have similar roles in an organization (executives, directors, engineers, and so on), or for users on specific company projects. Using the following steps, administrators can create query-based distribution groups:

1.	Open Active Directory User and Computers. Right-click in the container where you want to create a new group, select New, and then select Query-Based Distribution Group.
2.	As shown in Figure 3.4, the New Object-Query-based Distribution Group dialog box will appear. Type in a group name and, if required, a different alias for the group. Otherwise, the group name will be automatically inserted for the Exchange alias and will be used to set the group email address. Figure 3.4. Creating query-based distribution groups through Active Directory Users and Computers.
3.	The container in which the group is created defines the scope of the LDAP query. This means the query filter will apply to all recipients of the container selected and below the specified container. Choose one of the preconfigured filters; otherwise, select the Customize Filter option and click Customize. The Find Exchange Recipients dialog box, as shown in Figure 3.5, appears. Figure 3.5. Customizing the LDAP query filter parameters in the Find Exchange Recipients dialog box.
4.	Use the following tabs to configure additional parameters: General Used to select the recipient types in the group. Storage Used to limit the mailbox to a specific server or mailbox store. Advanced Used to create combinations of fields, operators, and search criteria.
5.	When you're finished selecting criteria, click OK to return to the wizard. Click Next and then click Finish to create the group. As with other groups, if creation of an email address was selected, SMTP and X.400 email addresses will be automatically created.

Again, after the group is created, administrators can manage additional group properties, such as adding members to the group, setting message size-restriction limits, changing, adding, or removing email addresses, limiting which users can send messages to the group, adding an expansion server, or configuring out-of-office options and nondelivery settings. Many settings can be configured; explore the ones that best fit your organi zation.

Renaming and Deleting Groups

Renaming and deleting groups each has a different effect on the security identifier (SID); object values are used to identify, handle, and track permissions independently of group names. When a group is renamed, the group is given a new label. Changing the name does not affect the SID, Exchange alias, or email addresses associates with the group. The group can be renamed in ADUC in two easy steps:

1.	Right-click the group name and then select Rename. Type in the new group name and press Enter.
2.	When the Rename Group dialog box appears, press Tab and type in a new pre-Windows 2000 group name; then click OK to complete the group rename.

Deleting a group removes it permanently from Active Directory. In theory, after a group is deleted, a group with the same name cannot be created with the same permissions of the original group. Group names can be reused, but because the SID of the new group name will not match the SID of the original group name, the permission settings must be manually re-created. Deleting a group is accomplished by highlighting the appropriate group, right-clicking, and selecting Delete or pressing the Delete key.

Note

Windows has built-in security features that will not allow deletion of built-in groups. There is no right-click Delete option and pressing Delete yields no results. Other group types can be removed using the previous steps.