Using Active Directory Groups for Permissions

Question

I have been researching the AD vs SharePoint group question and have found many conflicting answers. We are beginning a SharePoint 2013 on-prem implementation for an intranet serving about 4000 users and I am trying to determine the best way to set Access Controls. Currently, we are using WSS 3.0 and the permissions are handled completely through AD by our IT department. We don't see any necessity for exposing users to other departments and will likely continue to go through IT to make permission changes. Given this information, I wasn't able to find a definitive answer for the following questions:

• I read that while possible, it is not a recommended practice to assign permission directly to AD groups without invoking SharePoint groups. Why is this?

• Nesting AD groups within SharePoint groups limits visibility of users that have access to a particular site. Given that we likely do not want other departments to change permissions, is there any other functionality we would lose out on by using this model?

  I read that there are some collaborative tools that we will not be able to use, such as people picker, Lync presence, something about mySite, but I wasn't able to find a definitive answer. What are these tools that require adding users explicitly within SharePoint Groups?

Any help will be much appreciated.

Thanks.

Answer 1

One thing, new kind of direction MSFT recomending is.

We do not recommend SharePoint groups to assign permissions to sites. When a SharePoint group is used to assign permissions, a full crawl of the index occurs. Instead, we recommend Active Directory Domain Services (AD DS) groups

I think the best way to use the AD groups, it is easy to control and less impact on sharepoint.

If you

• add a user into sharepoint groups

• add Active Directory Groups into SharePoint Groups

• Adding Directly AD groups into sharepoint

  all scenarios will cause the search crawl.

But if you already added a AD group into SharePoint and then if you add a user into AD group from AD, then no crawl required to update the security.

Please this guide to understand what i am saying. he explain with exapmles: Clarifying Guidance on SharePoint Security Groups versus Active Directory Domain Services Groups

Answer 2

Actually I have done this in my project and I would say the best way going forward will be what your IT department is following right now .

It is always good to create security group , add members in the security group in AD and then give permissions to this security group in SharePoint .

Benefits-

1. You can manage the group from AD . If you want to remove access to particular user , just remove him from the security group in the AD and it will get reflected in SharePoint automatically .

2. Easy management and one of the most straight forward methods for managing permission . No need to search permissions for a user/member in SharePoint . Just check which security group the user belongs to and you will know the permission