Our SharePoint environment has various securable objects that grant permission (at very least read permission) to the Active Directory group "all authenticated users". In other words, up until now, we wanted everyone in the company to see this stuff. Our goal now is to explicitly deny access to a subset of authenticated users. Is there any way this is possible?
We thought about creating a sub-group (within Active Directory) called "all authenticated permissible users" and then searching SharePoint for every instance of "all authenticated users" and replacing one with the other, but this is undoubtedly problematic and "all authenticated users" will still be available for folks to use.
Any ideas are welcome! Thank you in advance!