I am working on an IDM system connecting 1.5 million users, of which about 600K are synced to Active Directory. 2008R2 Functional level for the forest.
One of the issues that interests me is the use of primraryGroupID. Of those 600K users, only 10 or so have primaryGroupID values other than 513. (513 is the RID of Domain Users I believe).
But the Domain Users group has only memberships for those 10 users whose primaryGroupID is NOT 513. Which is fine, as I understood this to mean that the primaryGroupID is an implicit group membership, and since it is using the RID of the group, I can see how that might work. Additionally, I am sure a single group with 600,000 members would not be a lot of fun in AD either.
But looking at another question about deleting a group that someone has as their primaryGroupID I found this KB 321360 article that says, the user HAS to be a member of the group referenced by the RID.
So here I have a system that demonstrably does not do that, and seems to be working. I feel like there is some detail I am missing. Perhaps different AD versions are different?
As a corollary, is there a difference in terms of rights/ACLs/inheritance for the primaryGroupID group vs a standard group?
