Can somebody point out to documentation or explain how verification works in AD DS when it is necessary to authorize user to perform some actions. As far as I remember user's SID or token should contain groups' SIDs added into it, but what I want to clarify is whether to verify/take authorization decision AD DS or any other authorization mechanism receiving user's SID tries to go out and check actual group membership by enumerating users in all groups to make sure that user still a member of this group (as I understand user's SID can contain SID of group from which he has already been removed, but his SID is not yet refreshed). Any good documentation/explanation about this particular aspect?

  • I think this depends on the way the security works on the particular resource being accessed. For NTFS access, the security token is checked, and AD is not requeried. That means if you remove a user from a group while they are logged on, they still have a token with that membership and can still access those resources. Vice versa applies when adding a user to a group. Again that's with respect to NTFS permissions, and SMB file and printer sharing. Other systems won't necessarily work the same way. – Todd Wilcox Jun 23 '15 at 12:58
  • @ToddWilcox So it seems that I won't get any answer as it is application and its authorization implementation specific then (and indeed I had some IIS web app in mind when asking my question). For other cases it is as you described no back check for group membership just accepting what's in the token. Thanks for your comment. – Mikhail Jun 23 '15 at 13:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.