It allows user both to create custom groups and to use information stored on the Windows server. In that case the user does not need (though he can) to manage his own groups because all the information is taken from the domain controller and represented as tree.