0

The case:

  • SharePoint 2013 Enterprise on-premises
  • Windows Authentication
  • There are about 20 AD domains in the company
  • Several thousands users
  • There is an AD group (that consists of another AD groups from all domains)

I need to allow access to the SP farm to users from the AD group only (and prohibit access to the SP farm to the others).

Improve this question
7
  • SharePoint Farm consist of several web applications, services, servers, sites, lists and items. On which of these element you want to allow access to this AD group?
    – Zakir HC
    May 19, 2015 at 8:05
  • @Zakir HC. Actually I want to allow access the AD group to the farm as a whole. Imagine a situation when in some company there is a branch the employes of which are spreaded across several AD domains. And I need to allow access to the SP farm to the branch employes only (not to the whole company)
    – Alexey Grachev
    May 19, 2015 at 8:30
  • To maintain a secure environment only one account must have access to the entire SP farm and i.e. the farm account. The farm account has priviledges to create Web applications, site collections, SSPs, configure Search, IFSS, Profile Imports, assigning permissions, and so on. Now how does your requirement matches with this one. I never in my career has seen granting a complete AD group access to the entire SP Farm !
    – Zakir HC
    May 19, 2015 at 8:38
  • Employees spreaded across regions are granted access to web applications, site collections and websites. What they would do with entire SP Farm !
    – Zakir HC
    May 19, 2015 at 8:39
  • @Zakir HC. Well possibly there is a AD group of company branch employees that are allowed to access the farm and there is another AD group with accounts of IT specialists that are allowd to manage the farm.
    – Alexey Grachev
    May 19, 2015 at 8:43

1 Answer 1

Reset to default
1

With our chat discussion (http://chat.stackexchange.com/rooms/23910/discussion-between-zakir-hc-and-alexey-grachev) I understand that you want to restrict certain set of AD groups access to entire farm. Example, users from ADGroup1 should be restricted to all site collections in the farm.

I do not know a way to restrict an AD group directly at farm level settings but yes this could be possibly done with creating User Policy for each web applications listed in Central Administration of a farm.

User Policy is the place where the magic happens in a web application level. User policy is basically a AD user or AD group mapping to certain Web Application Level Permission policy. You can even define a Zone in which the policy is applied.

You can read more about managing permission policies for a web application in SharePoint here: Manage permission policies for a web application in SharePoint

Open Central Admin > Manage Web Applications > Select 'Web Application' > On the ribbon click - User Policy > Add Users > Select a zone or All Zones > Click Next.

Among the listed Permissions if you find Deny All then select it and search your AD group in Choose Users people picker control. If you do not find Deny All permission level then create one using Permission Policy

For your reference. Here 'IT Service Desk' is one of our AD Group

enter image description here

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.