Consider the following scenario for Active Directory groups for Team Sites:

A1 (Top Level Site - Top level AD Group)
-B1 (Mid Level Site - 2nd level AD Group)
--C1 (Lower Level Site - 3rd level AD Group)

I would like a user that is added to "C4" to VIEW the entire site, including B1, C1, C2 and C3. I can make the C4 group inherit B2 (C4 is a member of B2), and B2 inherit A1 (B2 is a member of A1), but that will not give VIEW access to B1, C1, C2 or C3.

Each AD group is placed inside of its respective SharePoint group so there is a 1:1 relationship there (does this need changed?). The SharePoint groups have VIEW access to their respective sites.

I could potentially make A1 a member of all the 2nd level groups, but then I get into cyclical inheritance issue (I haven't tried this yet - is this an 'ok' thing to do? it seems... wrong somehow). This wouldn't give me access to the Third Level AD Groups though (C1 and C2) anyways.

Any ideas here? I just need users added to their respective AD groups at the level they have access to, but cannot figure out how to give access to an entire site that way. Basically, i can provide access to the 'single pipe upwards' but not 'upwards then downwards everywhere'.

Thanks, and if you need more information than my simple example above, please don't hesitate to ask.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.