What is the best way to manage the permission Hierarchy?

Question

Our current practices are composed of only using Active Directory groups for large swaths of access, such as the top site collection permissions. Any other permissions are to be handled within SharePoint groups themselves. What is the best way, from a central farm administration context, to manage access given by data owners to other users from within site collections.

It would seem to me that the out of the box tools would start to become unwieldy and wouldn't be scalable as the Farm grows.

Thoughts?

Answer 1

As you mentioned the out of the box tools seem a little limited when it comes to managing a large system. The ability for example to see what securable objects an individual has in a site collection or across the farm is non-existant. Being able to also match up if they have access via a AD Security group or directly with their account is also non-existant.

One of the most frequent IT requests I've seen is "give access like John Doe" to which my canned repy is "What access does John Doe have?"

Both DeliverPoint and ControlPoint have capabilities around managing permissions across all sites in the farm. The last time I was "inside" a company versus consulting, it took me less than an hour to prove an extremely quick ROI on the tools.

Answer 2

DeliverPoint

** Disclaimer **

I worked on the team that wrote the tool.

Answer 3

ControlPoint is the other popular tool.