0

In my sharepoint, I have assigned permissions for sites and pages by using only domain groups - that is, I am not using any sharepoint groups themselves. This works fine. It allows me to add and remove users via AD and I don't need to worry about administering within Sharpoint UI.

My question is, will the User Synchronization Service still sync user profiles if only domain groups are used?

Improve this question

2 Answers 2

Reset to default
1

Yes!

SharePoint groups can include Active Directory groups. But make sure these AD groups are security groups as opposed to distribution groups. You cannot add distribution groups to SP groups directly. If you have no choice but to use distribution groups then you can expand the distribution group in the SP group and add the individual members to a SP group (this will require manually keeping the SP group synchronized with the distribution group).

Advantages of using security groups:

  • You do not need to manage the individual users in the SP group; You manage the users centrally within the AD.
  • Once you add the security group to a SP group, you do not have to manage security group members in the SP group. For example, if a user is removed from the security group, the user will be automatically removed from the SP group.

Disadvantages of using security groups:

  • Adding security groups that contain deeply nested security groups, contacts, or distribution lists in not recommended. Deeply nested security groups might break SharePoint sites.
  • Using Security groups in SP sites does not provide full visibility of what is happening. For example, when a security group is added to a SP group for a specific site, the site will not appear in the user's My Sites. The User Information List will not show individual users until they have contributed to the site.
Improve this answer
7
  • Thanks for answering. I am now, indeed, managing all permissions via security groups (I think, if you give the group an email address, it becomes a distribution group as well). I don't manage users at all in sharepoint - only groups, and that via domain group names - I don't even use the sharepoint groups. So you are saying that if I control permissions in sharepoint using security groups, then the user profiles will synchronize?
    – bgmCoder
    Commented Jul 6, 2012 at 19:03
  • The best practice is to use SP groups to manage SP security, as much as possible, as opposed to not using SP groups. But, in either case, the user profiles will synchronize.
    – Hossein A
    Commented Jul 6, 2012 at 20:35
  • Why do you say SP groups are better to use than AD groups when all the users come from AD anyway?
    – bgmCoder
    Commented Jul 7, 2012 at 18:57
  • It is usually better to manage users in SP using SP groups vs. managing users individually within SP. I am not saying SP groups are better than AD groups. SP groups can consume AD groups.
    – Hossein A
    Commented Jul 8, 2012 at 5:55
  • But why is it better?
    – bgmCoder
    Commented Jul 10, 2012 at 13:56
1

In addition to the above answer, if a security group is used, I would suggest utilizing universal security groups.

Improve this answer
3
  • Presently, my groups are all Global Security groups (that is default, too, I think). Why would I want to make them "Universal"?
    – bgmCoder
    Commented Jul 7, 2012 at 13:50
  • Microsoft encouraged us to do it for our farm, which is running an Enterprise version of SharePoint 2010. We originally were using Global Security groups, but I think it pertained to Audience Targeting on a Microsoft-Hosted environment.
    – Quinn Johns
    Commented Jul 7, 2012 at 17:33
  • Okay, I can see where audience targeting could be useful. Good note that using universal groups have something to do with that.
    – bgmCoder
    Commented Jul 10, 2012 at 13:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.