Windows – How to a set a Security Group’s email address using PowerShell

You can exclude a specific user from a DD group with the Set-DynamicDistributionGroup commandlet. Specifically with the -RecipientFilter option.

Example: Set-DynamicDistributionGroup -Identity MadeUpName -RecipientFilter {((RecipientType -eq 'UserMailbox') -and -not(Name -like 'Journal User'))}

Note that this example is just with recipient type = userMailbox. You can get the current recipientFilter of your DD group and modify it however from powershell.

(get-DynamicDistributionGroup -Identity MadeUpName).RecipientFilter

No; distribution group membership checking is not recursive.

Exchange depends on the group expansion logic for nested membership, which means that all the groups down the chain must be mail-enabled.

It certainly would be nice if we could just dump security groups into distribution groups, especially if you've implemented role-based security, but the group expansion method fits a lot better with how a purely email implementation should behave.