My company has thousands of employees organized thoroughly via Active Directory. I have confidence in the accuracy of the Department and Title information displayed in the user profiles.

I'm helping to put up a brand new SharePoint 2007 site, and I contacted IT about managing the site's permissions through AD Groups. The goal is to have the site automatically assign read/write/contribute/whatever permissions based on the information in AD.

For example, we could create an AD Group called "Managers" that would contain anyone with the "Manager" title in their AD user profile. I would have SharePoint tap into this AD Group to mass assign permissions if I knew all managers would need a certain level of access (read/write/contribute/whatever). Then if a manager joins the company or leaves it, the group is automatically updated (provided AD gets updated, of course).

My IT rep called back and said it couldn't be done. This seems like a pretty straightforward business requirement, and one of the huge benefits of having Active Directory, but maybe I'm mistaken.

Could anyone shed some light on this?

A) Is it possible to use dynamically-updated AD Groups when assigning permissions via SharePoint? (Does anyone know of a guide I could show my doubtful IT rep?)

B) Is there a "best practice" way to go about this? I've read some debate on whether SharePoint Groups or AD Groups are the way to go. My main concern is dynamic updating.

C) If this isn't available out of the box, can someone recommend third-party software that will provide the functionality I'm looking for?

A big thanks to anyone who can help me out!!

2 Answers 2


If you have a "Manager" AD Group set as a certain permission in SharePoint, then that permission level will populate for all the users that is in that group. Any managers that are added to the AD Group will propagate to the associated permissions effective almost immediately. The problem in there lies that you would like to seperate permissions based on data from AD other than that of the group itself.

AD Groups are the best way to go. They can be easily updated, easy to track in AD, and SharePoint doesnt have to track all the users. Just assign the AD group to the permission level of the site collection, site, list, folder, or document.


Such "search groups" can't be created in Active Directory at this time.

That said, you can fake it with sufficient scripting and batch processing. It won't be real-time, but it'll get you there. We're using a similar process for creating groups based on employee-code (E1, E5, that kind of thing). It takes exports from our personnel system and modifies the groups based on those exports. It runs once a day.


You can do a fairly simple version of this with tools available on WinXP and higher:

dsquery * -filter (&(objectClass=User)(department=Facilities)) -Limit 5000 | dsmod group "CN=grp.departments.Facilities,OU=DepGroups,DC=Your,DC=Domain,DC=Here" -addmbr

That will query DS for all user objects with department set to "Facilities" (the dsquery * part) and pipe it into a command that'll modify the membership of "grp.departments.facilities" with the information returned by the query (the dsmod group part). You'll have to make one version of this for each Department, but this will do what you're looking for.

  • Can you provide any more information on your system? I found this for exporting AD info - computerperformance.co.uk/Logon/CSVDE_LDIFDE.htm - but I'm not sure what to tell my IT department about scripting and batch processing. Could you list the technologies I should be looking into?
    – rgmatthes
    Feb 1, 2011 at 20:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.