Original description:

When I create an AD group from Crowd, I get a "non-security" group (sAMAccountType == samNonSecurityGroupObject, groupType == [ GlobalScope ]). The groups I create from within AD are security groups (sAMAccountType == samGroupObject, groupType == [ GlobalScope, Security ]). The non-security groups don't work for restricting access to things using AD without involving Crowd.

I think it would be better if Crowd out-of-the-box would create security groups.

Distribution groups are required for nesting, but we should have option to use security groups if nesting is disabled.