Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

How many groups can an Active Directory account be member of?

Is there any hard limit, or do you know of other problems that can arise when you go over a certain number of group memberships?

Background: We have one account that is member of ca. 400 (possibly nested) groups, and we start to see issues in group policy handling for this account.

share|improve this question

4 Answers 4

up vote 6 down vote accepted

No, it's limited to 1015 (including nested groups) due to the size of a principal's security token. Here's an article that discusses AD limits, including group memberships. Have a look at the Group Memberships for Security Principals heading. Here's another KB article that talks about group memberships specifically.

There are exceptions when dealing with domain local groups outside of the domain the principal is a member of. From the KB linked to above:

The only exception to this behavior is that not all domain local security groups that the user is a member of will show up in the user’s token. The only domain local security groups that will show up (in the user’s token) are those groups that the user is a member of that also reside in the domain that contains the computer account that the user is logging on to.

share|improve this answer
    
Thanks for the answer. I guess we have to try and find a way to re-work the group structure for that particular user, as we are seeing timeout issues that are probably connected to this in other areas as well. –  Tomalak Oct 2 '09 at 12:16

This thread has a good discussion on the topic. Short answer: 1,015. Longer answer: less, depending on how many groups they belong to are nested within other groups.

share|improve this answer

I have seen values of 1000 to 1024 group memberships being the limit, im not sure its a hard limit, but membership of this many groups leads to "token bloat", as the token contains the SIDs of all group memberships.

In your case the user may be a member of 400 groups directly, but nested groups could increase that significantly.

share|improve this answer

Note that distribution groups don't factor in to these token size limitations being discussed here.

share|improve this answer
    
This question occurred to me as well. Thanks for the info. –  Tomalak Oct 2 '09 at 9:18

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.