Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible for a group to directly or indirectly include itself?

In other words, is it possible for the following structure to be created:

Group-A
  └─ Group-B
           └─ Group-C
                    └─ Group-A (recursive cycle)

Does AD detect and prevent such cases, or does it allow them and handle the recursive cycle.

If I had administrative access to an AD forest, and I wasn't afraid of unravelling the fabric of reality, I would test this myself. Google, sadly - has been of little help in answering this question ... although I may not be making the proper incantation in the search input box.

share|improve this question

2 Answers 2

up vote 6 down vote accepted

Directly: No, an error is returned that A group cannot be a member of itself

Indirectly: There is nothing preventing this from happening in Active Directory, and is known as Circular Group Nesting.

share|improve this answer

I have a different experience. If you use the Active Directory Users and Computers and do a right-click on a group then select "Add to a Group", you can enter the name of the group and the add succeeds, effectively making a group a member of itself.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.