---
description: What is security group ?
---

# security group

<figure><img src="https://3849832254-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0VV5UVf1Opf7lSgalz6c%2Fuploads%2F71YHSomRBoMzM3CQca7m%2FActive-Directory-Security-Groups.jpg?alt=media&#x26;token=27294e28-d151-4b64-9586-6b506d30e02b" alt=""><figcaption><p>AD Security Group </p></figcaption></figure>

## What is a Security Group?&#x20;

* A <mark style="color:blue;">**security group**</mark> is a logical entity in Windows that groups/collect (<mark style="color:blue;">**user accounts, computer accounts, and other groups**</mark> ) together into one logical unit for the purpose of assigning permissions and rights.&#x20;
* It is primarily used to manage access to resources in a domain or local computer environment.
* <mark style="color:blue;">**Security groups**</mark> are stored in the <mark style="color:blue;">**Active Directory (AD)**</mark> <mark style="color:blue;"></mark><mark style="color:blue;">database</mark> in domain environments or in the <mark style="color:blue;">**Security Accounts Manager (SAM)**</mark> database on local machines.

### What is primary functions of a security group are?

* <mark style="color:blue;">**Assign User Rights:**</mark> Assigning user rights to a security group determines what the members of that particular group can do within the scope of a domain. For example, a user who is added to the Backup Operators group can back-up and restore files and directories located on each domain controller in the domain. By being a member of this group, you inherit the user rights assigned to the group.
* <mark style="color:blue;">**Assign Permissions for Resources:**</mark> This is different from user rights because user rights apply across an entire domain versus permissions that are directed to a specific entity. Permissions determine who can access the resource and the level of access, such as Full Control or Read-only.

***

## How AD security groups work? <a href="#how-a-d-security-groups-work" id="how-a-d-security-groups-work"></a>

* Use groups to collect user accounts, computer accounts, and other groups into manageable units.
* &#x20;Working with groups instead of with individual users helps you simplify network maintenance and administration.

### AD has two types of groups:

* [<mark style="color:blue;">**Security groups**</mark>](#what-is-a-security-group)<mark style="color:blue;">:</mark> Use to assign permissions to shared resources.
* <mark style="color:blue;">**Distribution groups**</mark><mark style="color:blue;">:</mark> Use to create email distribution lists.

***

## What is a Distribution Group ?

* A <mark style="color:blue;">**distribution group**</mark> is a collection of user accounts, contacts, or other groups that can be addressed as a single entity, typically for sending emails or other forms of messaging.&#x20;
* When an email is sent to a distribution group, it is automatically forwarded to all members of the group.&#x20;
* This simplifies communication by allowing administrators or users to send messages to a large audience without manually entering each recipient’s email address.
* <mark style="color:blue;">**Finally**</mark> :&#x20;
  * Used for messaging (e.g., email lists).
  * Do not have a **Security Identifier (SID)**, so they cannot be used to assign permissions or rights.
  * Exist solely to facilitate communication.

***

Reference : [https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups)

