Forum Discussion

bart_vermeersch's avatar
bart_vermeersch
Iron Contributor
Jun 20, 2017

Using AD groups for setting security in Sharepoint

Recently we experience issues with SharePoint security set using AD groups:

 

Members of these groups are intermittently getting access denied. A few hours later they are able to access the resource (eg site) without error.

 

The strange thing is that if the AD group is encapsulated in a SharePoint security group, the issue is not present. Members of the AD group when encapsulated are not getting this erroneous behaviour.

7 Replies


  • Bart Vermeersch wrote:

     

    [..]

    The strange thing is that if the AD group is encapsulated in a SharePoint security group, the issue is not present. Members of the AD group when encapsulated are not getting this erroneous behaviour.


    Would need more clarification on this last paragraph of yours, specifically what do you mean by "encapsulation"? 

     

    I am not sure about the error, however for the other part - from what I can understand, this is actually a best practice. For any given site (or collection), there are by default at least three SP Groups - Site Visitor, Site Members, and Site Owners. You would typically add AD Security Groups to one of these default groups and are good to go. Should you need any specific access control, you create an SP Group and add the relevant AD Security Group there. 

     

    • Trevor Seward's avatar
      Trevor Seward
      MVP
      While AD groups may be 'best practice' from a Search performance perspective, they hamper end user control over permissions on a site and increase soft costs for IT. I think there's a good hybrid approach, where security groups are used for primary divisional/portal sites, but let users manage security on team-focused sites.
      • mdittakavi's avatar
        mdittakavi
        Copper Contributor

        Hi Trevor

         

        we have a issue when we add 'AD Security group' added to SharePoint (2016) . groups. the users able to login to the site, but they can't see any search results till we added them as individual. we got 4000+ users who need readonly access to the Intranet home pages. I have added the AD domain security group to the SharePoint groups.

        let us know where to check to resolve the issue. The ULS logs only says

         

        Microsoft.Office.Server.Search.Query.Ims.ImsQueryInternal : Number of tables in Result: 3, Relevant Results: 0 (Total: 0, Total including duplicates: 0),

         

        how a member of AD security group can see the search results. we are using Cloud Search service application.

Resources