For our extranet User Portal, there are two types of users:

  • Employees who log into the site via windows authentication
  • Customers who log into the site via forms authentication

I'd like to create specific areas (i.e. pages or or subsites) that only employees can see.

Normally I would secure this by a group, but anyone on the domain controller can log on, and there's no common group that all the employees belong to (from what I can tell) in AD. It is guaranteed that all domain accounts will be employees, however.

I'm using the default SQL Server membership provider with no customizations for my customers.

Any ideas on how I can control access to employees without a lot of manual intervent? (i.e. adding all external employees to a new group).

2 Answers 2


It seems that NT AUTHORITY\authenticated users corresponds to Windows domain authenticated users, and not forms authenticated users.

If you're looking to distinguish between forms users and windows authenticated users, use All Users ([MembershipProvider]) for forms users, and NT AUTHORITY\authenticated for windows authenticated users.


The AD Everyone group includes all AD users and does not include the FBA Users, you can try using that.

  • The Everyone group seems to allow access to all authenticated users (FBA or Windows). Commented Mar 5, 2015 at 15:51
  • The windows AD has an Everyone group, try typing it in with the Domain added to it, like MyDomain\Everyone. I've also seen SP add an All Authenticated Users for each membership provider installed... It shouldn't be reporting FBA users as members of the AD Group...
    – Choggo
    Commented Mar 5, 2015 at 15:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.