Active directory distribution group and user permission?

Question

We have two active directory security groups(internal) added into the sharepoint members group explicitly. GroupB is a subgroup of GroupA, when I search a user permission (went to the member group and used check user permission button) for a user belongs to GroupB it returns that the user belongs to GroupB and has contribute permission however when I search for user belongs to GroupA it returns the user does not have any permission on the site.

As far as I know, SharePoint retreats the active directory group like a normal user and does not know the members of the group as it will authenticate the user against active directory.

How does the search works for GroupB and not for the other one? what is the issue?

Answer 1

You can't use distribution groups for security in SharePoint. If you're doing this with Group A, then this likely explains the difference you see for this group's members.

SharePoint does treat AD groups as SPUser objects within the farm so sometimes it can be hard to trace a user's permissions. That said, if they are a member of a security group and you have provided the security group a certain level of access, the user should also have this access.

In addition to not using security groups, it's not recommended to use security groups with nested groups (either security or distribution groups) as it can be really hard to trace a user's permission from within SharePoint.

Answer 2

Does the user belonging to group B have individual permissions set in SharePoint i.e. exists in the Members SharePoint group alongside Group A and Group B? If so the Permissions Checking tool might be picking up the SharePoint accounts rather than the AD acsounts.

Just tested this with a setup here and the user who had individual membership to Members (and their group too - i.e. same as your A group user) showed their Member membership instead of their group membership in the permissions checker. A member of the B AD group showed who deosnt exist within Sharepoint/Members showed their AD group membership.

Answer 3

you cannot add distribution groups to SharePoint groups, but you can expand a distribution group and add the individual members to a SharePoint group. If you use this method, you must manually keep the SharePoint group synchronized with the distribution group

https://technet.microsoft.com/en-us/library/cc261972.aspx

I do not know how, but info-path forms in SharePoint can use distribution groups in Person/Group Picker Control