We have two active directory security groups(internal) added into the sharepoint members group explicitly. GroupB is a subgroup of GroupA, when I search a user permission (went to the member group and used check user permission button) for a user belongs to GroupB it returns that the user belongs to GroupB and has contribute permission however when I search for user belongs to GroupA it returns the user does not have any permission on the site.

As far as I know, SharePoint retreats the active directory group like a normal user and does not know the members of the group as it will authenticate the user against active directory.

How does the search works for GroupB and not for the other one? what is the issue?

  • You may want to rephrase the question a bit so it is more clear. How are you "searching a user permission" for example?
    – Paul Lucas
    Nov 9, 2011 at 2:46
  • Ok, so is GroupA added to the SharePoint members group explicitly?
    – Paul Lucas
    Nov 9, 2011 at 13:45
  • yes, both the groups(GroupA & GroupB) are added into the SharePoint members group explicitly. Nov 9, 2011 at 14:45
  • is that mean that SharePoint does not consider/work for the user if he/she belongs to a security group which has a subgroup... Nov 9, 2011 at 14:48
  • 1
    The user you can find, did they log into SharePoint already? Did the users you can't find log in yet? I have found that if members of an AD group don't log in, they don't get a SP profile in the actual site collection correctly. Nov 14, 2011 at 13:07

3 Answers 3


You can't use distribution groups for security in SharePoint. If you're doing this with Group A, then this likely explains the difference you see for this group's members.

SharePoint does treat AD groups as SPUser objects within the farm so sometimes it can be hard to trace a user's permissions. That said, if they are a member of a security group and you have provided the security group a certain level of access, the user should also have this access.

In addition to not using security groups, it's not recommended to use security groups with nested groups (either security or distribution groups) as it can be really hard to trace a user's permission from within SharePoint.


Does the user belonging to group B have individual permissions set in SharePoint i.e. exists in the Members SharePoint group alongside Group A and Group B? If so the Permissions Checking tool might be picking up the SharePoint accounts rather than the AD acsounts.

Just tested this with a setup here and the user who had individual membership to Members (and their group too - i.e. same as your A group user) showed their Member membership instead of their group membership in the permissions checker. A member of the B AD group showed who deosnt exist within Sharepoint/Members showed their AD group membership.


you cannot add distribution groups to SharePoint groups, but you can expand a distribution group and add the individual members to a SharePoint group. If you use this method, you must manually keep the SharePoint group synchronized with the distribution group


I do not know how, but info-path forms in SharePoint can use distribution groups in Person/Group Picker Control

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.