For instance: ads\mdepnorm aka MDEP TSST Norman Testing is in SP-CONTRIBUTORS ADS security group:

enter image description here enter image description here.

The sp-contributors ADS group is in SharePoint group Intranet Members:

enter image description here enter image description here.

It follows that if I check permissions for ads\mdepnorm that Edit level permission will appear Given through the "Intranet Members" group. However, this is not the case:

enter image description here.

Permission levels given to MDEP TSST Norman Testing (i:0#.w|ads\mdepnorm) is None.

However, I can log into the site and edit. I logged in with mdepnorm and created an impromptu list called I Made This:

enter image description here.

So, Check Permissions is definitely not reporting the correct permissions. This is only happening for ADS users belonging to ADS groups nested in SP groups. If I explicitly place mdepnorm in the Intranet Members SP group, permissions are reported correctly as Edit Given through the “Intranet Members” group.

enter image description here enter image description here

What is causing this to happen? What setting(s) do I need to check to figure this out? We plan to manage our new SP 13 environment this way, by nesting ADS groups within SP groups, and it’s going to be extremely inconvenient—at least—to not have correct reporting of permissions.

2 Answers 2


Add farm account(s) to AD security group Windows Authorization Access Group.

Added farm services accounts to the AD security group Windows Authorization Access Group, because in order for Check Permissions to work whatever account is running the background service needs read access to the TGGAU (tokenGroupsGlobalAndUniversal) attribute of the account being checked.


Have come across this in one environment. We tried to solve it with MS Support, but were not successful. The last thing MS said was that SharePoint was OK, it was just getting wrong token from the AD - so the error was outside SharePoint in our case. They did not provide us with root cause analysis anyway, so we still are facing this issue and using workaround.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.