Active Directory Nesting Limit for TS

System

We currently run TS 6.5 on Windows 2K with Active Directory from multiple domains. My clients create security groups on their domain which I then nest in security groups on my domain and therefore apply all TS permissions from groups on my domain while still allow clients control to add/remove people. I recently tried nesting one of my security groups inside another to grant permissions, but it failed to grant my client the expected permissions. The client user was therefore nested in three different groups: theirs and two of mine. I could be wrong, I'm not super skilled with AD, but I don't think this is an AD issue. It seems like TS can't follow that deep. Has anyone had some experience with this?

Thanks much.
Brian

Adam Stoller

We currently run TS 6.5 on Windows 2K with Active Directory from multiple domains. My clients create security groups on their domain which I then nest in security groups on my domain and therefore apply all TS permissions from groups on my domain while still allow clients control to add/remove people. I recently tried nesting one of my security groups inside another to grant permissions, but it failed to grant my client the expected permissions. The client user was therefore nested in three different groups: theirs and two of mine. I could be wrong, I'm not super skilled with AD, but I don't think this is an AD issue. It seems like TS can't follow that deep. Has anyone had some experience with this? Thanks much. Brian

The only experience I've had with this was similar I believe to what you are seeing - which is that a userid within a domain-global-group [group-A] nested within a domain-local-group [group-B] will be interpreted correctly by Windows and TeamSite - but if the userid is in a domain-****-group [group-C] nested within the domain-global-group [group-A] nested within the domain-local-group [group-B] - then the userid will not be recognized as being a member of the domain-local-group.

Our experience seemed to show this as a limitation of both Windows and TeamSite - but since the latter was the primary concern we didn't spend too much time looking at the former. We just got rid of one of the levels of nesting.