| Organizational Units | Groups | |
|---|---|---|
| Purpose | Structure, delegation, GPOs | Access control, distribution |
| Can assign permissions | No | Yes |
| Can apply GPOs | Yes | No |
| Can contain | Users, computers, groups, OUs | Users, computers, groups |
| Nesting | Yes (OUs in OUs) | Yes (groups in groups) |
| Scope | Only within AD domain hierarchy | Security or email distribution |
| Admin delegation | Yes | No |