2

I have this case:
DOMAIN1\GroupA (Group type "Security", scope "Domain Local")
DOMAIN2\GroupB (Group type "Security", scope "Global")
GroupB is inside GroupA.
In a SharePoint subsite I have a SharePoint group which contains GroupA.
Users inside GroupB are not able to get permissions on this site. I can't test directly if users inside GroupA are able because this group is just a "container".

Is there a particular reason why this is not working? Maybe is because GroupA and GroupB are from different domains? Or maybe because the Global group is inside the Domain Local one?
I can provide to you more informations if it's required.
Thanks in advance.

Improve this question

1 Answer 1

Reset to default
4

Nested AD Groups are not recommended with SharePoint and can lead to the results you're seeing. Unnest the groups [with SharePoint].

Improve this answer
2
  • Can you provide some articles that explain this case? It will be helpful a lot to me.
    – Omar93
    Oct 9, 2017 at 15:53
  • First, technet.microsoft.com/en-us/library/cc261972.aspx. Second issue is that if you're crossing forests domain boundaries, SharePoint will see objects within the group on the external domain as a Foreign Security Principal. SharePoint cannot 'see' FSPs. You can add users to a group in DOMAIN2 and assign that group to SharePoint, but users who are enumerated through a group in DOMAIN1 but exist in DOMAIN2 won't work due to them being an FSP to DOMAIN1.
    – user6024
    Oct 9, 2017 at 15:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.