2

My organization has a small SharePoint server (WSS 3.0). Many of the permissions are assigned by putting an Active Directory Security Group as a user inside of a SharePoint group. Until now, this has worked fine. Recently, we noticed that when new users were added to these Active Directory Security Groups, the effective permissions did not update accordingly.

A more concrete example if I was unclear: There is a SharePoint group called 'Information Document Library Members.' This group contains the Active Directory security group 'COMPANYNAME\information'. The SharePoint group has Content Management rights to 'Folder X'. When we add new user 'John Smith' to 'COMPANYNAME\information' in Active Directory, he should automatically get permissions to Folder X, but he isn't. The 'Check Effective Permissions' tool shows only the old permissions, not the ones just added through Active Directory.

This used to work fine, but it doesn't now. We tried rebooting the SharePoint server and it did not make any difference. Any idea how to make this work properly again?

Josh G.
  • 21
  • 2

1 Answers1

1

I asked a similar question on the Sharepoint StackOverflow site. Specifically this referred to using AD groups in Audiences, but some of the info may be applicable.

Check some of the following:

  1. Use a Global Security Group
    • Sharepoint 2007 seems to find groups even outside the scope specfied. That is a bit annoying for My Site profiles, as you can't hide groups with email addresses, but here it makes things a little less complicated.
    • Group does not need to be mail enabled
    • Exchange enabled groups do not need to be visible to address lists
    • Distribution Groups will not work
  2. Add at least one user to the group
    • Empty groups are not picked up
  3. Run a full profile import to pick up the group from AD
    • An incremental import is required to pick up changes to group membership, but won't get new groups
  4. Wait for 10 minutes - it can take a while before the import process is complete, despite SharePoint saying it is Idle.
Community
  • 1
dunxd
  • 9,482
  • 21
  • 80
  • 117
  • My security groups are Universal, not Global. Should that make a difference? Also, how *do* you perform an AD import on WSS 3.0? I would have tried this if possible, but haven't been able to find any information on it. Nothing in Central Management seems to offer this option. – Josh G. Jan 26 '12 at 16:27
  • Joel Olson has a long blog entry on use of different group types at http://blogs.msdn.com/b/joelo/archive/2007/06/29/sharepoint-groups-permissions-site-security-and-depreciated-site-groups.aspx. Probably worth a look there. – dunxd Jan 29 '12 at 21:04