Tell me more ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.
up vote 0 down vote favorite

We currently have two farms - a SharePoint 2007 one and a SharePoint 2010 one. We have the same groups in both farms and the same userbase.

At the moment when someone joins or leaves the company we're adding/removing them from both sets of role groups. Is there a better way to approach this?

share|improve this question

1 Answer

up vote 0 down vote

Active Directory security groups are a logical choice as you would only need to remove the user's membership from the groups to stop their access and vice versa -- add them to the groups to grant them access.

However, you cannot nest AD groups (that is, you can't have groups within groups) so for this to work you need to have all the users in a group which could mean you'll have lots of groups and users may be members of lots of groups as well.

share|improve this answer
Unfortunately not an option in this case – Michael Dec 13 '12 at 4:04
May I ask what sort of constraints you have that would prevent using this model? – shufler Dec 13 '12 at 16:13
One business unit manages the environment, another the active directory network. The one that manages the environment is only site collection administrators. – Michael Dec 13 '12 at 23:02
OK, I understand there is a separation of duties, but can the SharePoint administrators provide the AD administrators with a list of groups and users to set up in AD? To be fair, you would require this with nested groups as well (unless the groups already exist) – shufler Dec 14 '12 at 1:28
In theory - but unfortunately it's big business and communication between the teams is poor at best, unworkable at worst. It's far more feasible in this scenario to manage this from role groups – Michael Dec 14 '12 at 3:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.