Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

In my sharepoint, I have assigned permissions for sites and pages by using only domain groups - that is, I am not using any sharepoint groups themselves. This works fine. It allows me to add and remove users via AD and I don't need to worry about administering within Sharpoint UI.

My question is, will the User Synchronization Service still sync user profiles if only domain groups are used?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

Yes!

SharePoint groups can include Active Directory groups. But make sure these AD groups are security groups as opposed to distribution groups. You cannot add distribution groups to SP groups directly. If you have no choice but to use distribution groups then you can expand the distribution group in the SP group and add the individual members to a SP group (this will require manually keeping the SP group synchronized with the distribution group).

Advantages of using security groups:

  • You do not need to manage the individual users in the SP group; You manage the users centrally within the AD.
  • Once you add the security group to a SP group, you do not have to manage security group members in the SP group. For example, if a user is removed from the security group, the user will be automatically removed from the SP group.

Disadvantages of using security groups:

  • Adding security groups that contain deeply nested security groups, contacts, or distribution lists in not recommended. Deeply nested security groups might break SharePoint sites.
  • Using Security groups in SP sites does not provide full visibility of what is happening. For example, when a security group is added to a SP group for a specific site, the site will not appear in the user's My Sites. The User Information List will not show individual users until they have contributed to the site.
share|improve this answer
    
Thanks for answering. I am now, indeed, managing all permissions via security groups (I think, if you give the group an email address, it becomes a distribution group as well). I don't manage users at all in sharepoint - only groups, and that via domain group names - I don't even use the sharepoint groups. So you are saying that if I control permissions in sharepoint using security groups, then the user profiles will synchronize? –  BGM Jul 6 '12 at 19:03
    
The best practice is to use SP groups to manage SP security, as much as possible, as opposed to not using SP groups. But, in either case, the user profiles will synchronize. –  Hossein Aarabi Jul 6 '12 at 20:35
    
Why do you say SP groups are better to use than AD groups when all the users come from AD anyway? –  BGM Jul 7 '12 at 18:57
    
It is usually better to manage users in SP using SP groups vs. managing users individually within SP. I am not saying SP groups are better than AD groups. SP groups can consume AD groups. –  Hossein Aarabi Jul 8 '12 at 5:55
    
But why is it better? –  BGM Jul 10 '12 at 13:56

In addition to the above answer, if a security group is used, I would suggest utilizing universal security groups.

share|improve this answer
    
Presently, my groups are all Global Security groups (that is default, too, I think). Why would I want to make them "Universal"? –  BGM Jul 7 '12 at 13:50
    
Microsoft encouraged us to do it for our farm, which is running an Enterprise version of SharePoint 2010. We originally were using Global Security groups, but I think it pertained to Audience Targeting on a Microsoft-Hosted environment. –  Quinn Johns Jul 7 '12 at 17:33
    
Okay, I can see where audience targeting could be useful. Good note that using universal groups have something to do with that. –  BGM Jul 10 '12 at 13:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.