Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

Let's say I have an AD group called domain\Group1, in SharePoint I create a group called Group 1. In the SharePoint group I add the corresponding domain group. Now if I add a user to the domain group, shouldn't that user have access to wherever the SharePoint group have access or does the UPS have to be set up for this? I don't won't to write back to AD or anything, just grant users access.

Thanks in advance.

share|improve this question
    
Is your active directory group security enabled? It should be since you were able to add it to the SharePoint group... –  Kit Menke Sep 3 '13 at 17:13

2 Answers 2

Late answer but, The User Profile is not responsible in this case.

SharePoint recognizes AD security groups and attaching permissions to these groups will cause the permissions to be granted to the User.

Unfortunately, due to SharePoint caching the user's memberships on login, changes made to a security group are identified only after the cache has expired, possibly taking as long as 10 hours (by default) for it to happen.

This causes the unexpected behavior of adding a user to a Group and the user still being shown the access denied or lack of interface feedback related to the new permissions he should have received.

The user not having his tokens cached prior to being added to the group would cause him to receive access immediately.

Serge Luca's Blog

Viorel Lftode's Blog

share|improve this answer

Instead of changing the STS configuration as suggested in the blog posts, I'd suggest to just clear the Logon Token Cache.

Clear-SPDistributedCacheItem –ContainerType DistributedLogonTokenCache 
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.