I am looking into restructuring our AD Groups Infrastructure and am having a hard time find the best way to reorganize.

The reason this is a unique challenge is because of our employee roles. No two individuals, even in the same dept, require the same access. Our old role had a mixture of providing individuals with direct access or putting users into generalized groups that had permissions to too many resources.

Because this isn't a typical or simple, put a user into a dept group, it leaves me with few options. I was thinking of creating security groups for all resources and adding individuals to groups for the resource they require. There's probably a lot of cons of doing things this way.

One of the cons is having too many security groups. Easily over a hundred.

Pros, easily documented in the group description and easy to find what permissions a user has access to.

What is the best practice in this instance and what have you found to work?

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.