SharePoint permissions reading from AD

Question

I have a SharePoint sub web with unique permissions, within the site I have 3 SharePoint groups (Owner, Contributor and Viewers), in each of these groups I am including an Active Directory group.

Users within the group can log into SharePoint and see lists fine, however when I go to the site permissions and click 'check permissions' the user doesn't have permissions and subsequently doesn't receive alerts from the task list.

If I don't use the AD group and add users to the SharePoint group, I can see the permissions using 'check permissions' and the alerts are received.

Is there a reason why the AD permissions aren't working from a sub web - I have the same setup for a site collection and it works fine. Just not the sub web.

Answer 1

This mix of AD groups and SharePoint groups is always a problem. You sort of get 2/3 of what you want by using AD groups and 2/3 by using SharePoint groups. It really comes down to what is more important to you.

I have a couple of blog posts on this dilemma: http://sympmarc.com/2011/02/16/active-directory-groups-vs-sharepoint-groups-for-user-management-a-dilemma/