| Platform SDK: Active Directory, ADSI, and Directory Services |
A group can be a security group or a distribution group.
Security groups are listed in access-control lists (ACLs), which define permissions on resources and objects. Security groups can also be used as an e-mail entity. Sending an e-mail message to the group sends the message to all the members of the group.
Distribution groups are not security enabled. Distribution groups provide a subset of the functionality of security groups. Distribution groups cannot be listed in ACLs. Distribution groups can be used only for grouping purposes. For example, distribution lists can be used with e-mail applications (such as Exchange) to send e-mail to collections of users.
If you do not need a group for security purposes, create a distribution group instead. Using a distribution group improves performance because distribution groups are ignored when Windows 2000 builds the user security token during the logon process. This also reduces the size of the token, improving performance as the token is sent to various computers the user accesses.