Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

We have two active directory security groups(internal) added into the sharepoint members group explicitly. GroupB is a subgroup of GroupA, when I search a user permission (went to the member group and used check user permission button) for a user belongs to GroupB it returns that the user belongs to GroupB and has contribute permission however when I search for user belongs to GroupA it returns the user does not have any permission on the site.

As far as I know, SharePoint retreats the active directory group like a normal user and does not know the members of the group as it will authenticate the user against active directory.

How does the search works for GroupB and not for the other one? what is the issue?

share|improve this question
    
You may want to rephrase the question a bit so it is more clear. How are you "searching a user permission" for example? –  Paul Lucas Nov 9 '11 at 2:46
    
Ok, so is GroupA added to the SharePoint members group explicitly? –  Paul Lucas Nov 9 '11 at 13:45
    
yes, both the groups(GroupA & GroupB) are added into the SharePoint members group explicitly. –  Karthikeyan Nov 9 '11 at 14:45
    
is that mean that SharePoint does not consider/work for the user if he/she belongs to a security group which has a subgroup... –  Karthikeyan Nov 9 '11 at 14:48
1  
The user you can find, did they log into SharePoint already? Did the users you can't find log in yet? I have found that if members of an AD group don't log in, they don't get a SP profile in the actual site collection correctly. –  David Lozzi Nov 14 '11 at 13:07
show 1 more comment

2 Answers 2

You can't use distribution groups for security in SharePoint. If you're doing this with Group A, then this likely explains the difference you see for this group's members.

SharePoint does treat AD groups as SPUser objects within the farm so sometimes it can be hard to trace a user's permissions. That said, if they are a member of a security group and you have provided the security group a certain level of access, the user should also have this access.

In addition to not using security groups, it's not recommended to use security groups with nested groups (either security or distribution groups) as it can be really hard to trace a user's permission from within SharePoint.

share|improve this answer
add comment

Does the user belonging to group B have individual permissions set in SharePoint i.e. exists in the Members SharePoint group alongside Group A and Group B? If so the Permissions Checking tool might be picking up the SharePoint accounts rather than the AD acsounts.

Just tested this with a setup here and the user who had individual membership to Members (and their group too - i.e. same as your A group user) showed their Member membership instead of their group membership in the permissions checker. A member of the B AD group showed who deosnt exist within Sharepoint/Members showed their AD group membership.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.