What's a reasonable max number of users I should put in a mail-enabled security group?

Question

My company uses PowerShell to manage the members of thousands of groups. There are SQL statements and other "rules" that govern who should be a member of a given group. This solution does not really lend itself to creating groups and then nesting the groups within larger groups... it just adds users to groups.

These security groups are rarely used for securing resources... when we do, we tend to create a group to manage the ACL, then drop the mail-enabled group into the ACL group.

My question is: Is there a threshold number of users where I should really be thinking of nesting groups rather than adding people directly? We have < 3000 people in the entire company.

Answer 1

Not for most organizations, and 3,000 isn't enough to cause problems.

Prior to Active Directory 2003, when a member was added/removed to/from a group the entire group membership was re-replicated. This was crazy and Microsoft recommended no more than 5,000 members per group (see below). Active Directory 2003 introduced linked-value replication. When members are added/removed only the changes are replicated. Prior to this, it was not unusual in large multi-domain forests to have most changes to Global groups, and a Universal group to combine all the Global groups for ACL purposes because Global group members are not replicated to other domains.

One scenario where this problem may still exist is in very old directories, groups created prior to Active Directory 2003 may still have legacy members. These can be fixed by removing/re-adding the members.

There is a practical limit on the number of add/removes in a single LDAP transaction: 5,000. This is the number of changes that Active Directory can safely commit for an object in a single database transaction. So if you were adding/removing 100,000 members, it would be best to do no more than 5,000 at a time.

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc756101(v=ws.10)

Answer 2

As Greg Askew mentioned, the recommended maximum number of members in a group is 5000 on Windows 2000 AD environments, and the allowed number of members is to exceed 5000 after increasing the forest function level, according to your member number, it will not be a worry for you. If you want to manage these members better, you could try to use nesting groups.