Can security groups on Active Directory get email addresses automatically?

Question

Exchange 2010 SP2 Server +Active Directory

I created ~200 security groups using Active Directory and after some time I noticed that in the Exchange Console on Recipient > Distribution Groups some (not all) of my security groups were being shown there.

I rechecked the groups and Active Directory is telling me they are Security Groups but they also, somehow acquired an email address - I didn't enter it manually.

The groups also have their symbol Grayed Out in the Exchange Console.

Any insight on why or how they got an email address in the first place?

Answer 1

You could script such a system, but there is a difference between Security groups and Distribution groups.

Distribution groups get email addresses by default in a normal setup, Security groups do not.

In order for a Security Group to be used to control access to an Exchange resource, it must be something called a "Mail-enabled Security Group" which is a Security Group that has been given status as a Distribution Group.

There are a few ways to accomplish this depending on your setup. But the first thing to do is to make sure the scope of the group is set to Universal.

Then it's perhaps easiest to use Powershell:

Enable-DistributionGroup -Identity "Server Lab 222"

There are plenty of parameters you can use with this, but basically it'll take the Security Group "Server Lab 222" and mail-enable it, giving it an email address.

Update

Then use the command Disable-DistributionGroup. It's got the same syntax.

You may want to try creating a few groups with different settings to see if there are circumstances where the groups are created with email addresses.

Like I said earlier though, if you're using a security group to control access to any Exchange resources, that group will be mail-enabled by requirement.

See here for more information: https://technet.microsoft.com/en-us/library/bb123805%28v=exchg.141%29.aspx?f=255&MSPPError=-2147217396