Forum Discussion
Using AD groups for setting security in Sharepoint
From the Search perspective you to take a hit when individual permissions are used as opposed to AD. When you add individuals to a SP group a full crawl will be launched at the next pass of content in order to calculate the ACLs for each individual. So - if you add 100 individuals you will have 100 ACLs calculated for every piece of content. If you have 1 AD group with 100 users you only have 1% of the hit in the crawl.
Precisely as Trevor Seward stated the general guidance from Technet is this :
Considering the previous advantages and disadvantages, here are the recommendations:
- For intranet sites that are broadly accessed by your users, use security groups because you do not care about the individual users who accessed the intranet site home page.
- For collaboration sites that are accessed by a small group of users, add users directly to SharePoint groups. In this case, there is more of a need to know who is a member so the group members know each other’s e-mail addresses and how to contact one another.
To go back to my initial issue ;-)
We found there are two seperate issues, the one we figured out properly goes as follows:
Target audiences set on navigation menu (I know it's not best practice from perfomance point of view).
If the target audience contains a (synced) AD group, it sometimes fails (members of the AD group don't see the menu item).
If a SharePoint groups is created with the AD group as only member, and this SharePoint group is put in the target audience, we don't experience any issues.
So we are creating SharePoint groups (for every AD groups) and use these for target audience.
- Was the audience being compiled after a member was added/removed from the AD group? Compilation only occurs on Sunday in the early AM hours (enforced Online, adjustable on-prem).
Trevor Seward interesting discussion that reveals a lot. Where is this knowledge documented: "Compilation only occurs on Sunday in the early AM hours" for SharePoint Online? Is that still the case?
