Software

Ask something
Question Locked

Active Directory Maximum Group Membership

0 helpful
6 replies

by abhill

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Does anyone know if there's a max limit to group membership (global security groups) in AD 2003? I have a supplier who insists we add every user to a specific group for their product because their product can't handle nested groups! My worry is whether taking such action would have any performance issues for AD (in essence this is like duplicating the "Domain Users" group).

Can anyone advise?

6 replies

by scott_heath

It shouldn't cause any issues unless it is a Universal group due to the way it replicates group information.

by abhill

Is the Gobal Catalog affected by Security Groups?

by scott_heath

... a reference site with more details, but I couldn't and I don't have much more time to Google for it. Basically if you have a single domain controller there isn't much to worry about. When you have multiple DCs when you have 20,000 users in a group and it has to replicate the whole group you are increasing traffic. of course if your DCs sit on a fiber backbone in the same datacenter, that doesn't matter much either.

Do some Google-ing and see what you find. I don't think you will have any issues though. I doubt we are talking about more than a couple thousand objects, correct?

by cg it

10 million objects is the maximum in W2K environment users, computers, groups, OUs, security policies.

you can nest groups and assign permissions to users that way, but the administrative and documentation effort can be daunting.

by abhill

Thanks for post Scott. I'm probably looking at adding up to 10,000 users to a single group. That would replicated round 4 DCs across two campuses which will be connected by fibre. I tried Googling for answers but didn't come up with much. Can't even find much related to this (with AD 2003) on Microsoft site. Maybe I should send the question to Mr Gates!

This discussion is closed to new replies.