For each client, I have set up a main folder and service subfolders. These folders have Access-Based Enumberation (ABE) enabled and users belonging to the correct Security Groups (SGs) are able to view and access permitted folders while other folders are hidden away due to ABE. However, I've gotten to the point where we have more than 800 clients, each having 2-3 services, resulting in some users belonging to more than 1010 SGs. This resulted in those users not able to log in, as explained in https://support.microsoft.com/en-us/kb/328889.
So, if we can't use SGs and ABE in a scalable manner, what other methods work better? It's not by increasing the MaxTokenSize as that has no bearing on the LSA/login portion. I already increased it to 48000 and it doesn't help.
Regards,
John Babbitt
Systems Administrator