Hello - I have a site at "/" and 5 sites under that site. Currently I have 10 active directory groups containing users added to each sub site. Can you create a new group in "Central Administration > People and Groups" that has access to all sites by default. My goal is to not have to add all 10 active directory groups to every NEW site I create. Ideas?

In Central Adminitsrtion you can add the 10 groups once by gpoing to Central Administration > Application Management > Policy for Web Application > Choose the web App from the drop down then add the users. However, the user rights given at this level will over ride any user rights given or removed on the site... Cheers, -IvanIvan Sanders My LinkedIn Profile, My Blog, @iasanders.

OK - So its looks like I have 3 options here: 1. Add all of the active directory groups to the Top Level Site using Policy for Web Application with a custom permission policy. This would cover all new sites and I would never have to worry about another permission. UNTIL I add a site that I DO NOT want everyone to have access too. 2. Create a group in "Central Administration > People and Groups" containing all of the active directory group. Then Central Administration > People and Groups > Set Up Groups for this Site. This would again cover all new sites and I would never have to worry about another permission. UNTIL I add a site that I DO NOT want everyone to have access too. 3. Create a NEW active directory group that would contain all of the other active directory groups that need permission to all current and new sites. Then when I create a new site I only have to add the 1 NEW active directory group to the new site. (which contain all my other active directory group) Thoughts on which approach is better? What are the pro's and con's of each? Cheers

Hi, I dont really like 2 of the options, your solution or the 3rd choice is the best: Assumption by Site you mean Site Collection 1. Adding all users to groups and giving access to CA is a bad idea and doesnt resolve your issue.. 2. The idea I proposed is not the correct response for this instance due to not being able to over ride the permissions @ the site level, this should be used sparingly. 3. Create an AD Group that will contain your other AD Groups and add the once when provioning each site collection. The only issue that can come up is deeply nested groups and or creating contacts in the AD Groups.. -IvanIvan Sanders My LinkedIn Profile, My Blog, @iasanders.