We have an enterprising developer who created a process to nightly create 3,600 groups with possibly changing membership. Every night, his process deletes all 3,600 groups, pulls a list from a datasource of varous students and their programs and uses it to recreate all 3,600 groups. Is this a problem for AD, in terms of running out of SIDs or problems upgrading the domain to 2008 R2 or something? Is there a place we can point him for a better way to do this? Say, keeping the groups intact but changing the membership based on the data?

Active Directory Maximum Limits - Scalabilityhttp://technet.microsoft.com/en-us/library/cc756101(WS.10).aspx#BKMK_SIDsYou aren't in danger of running out of sids, for about 700 years (1billion/3600/365)???I agree deleting and creating groups (with the same name) is not an effecient approach. Talking to your developer abou the fact he can reuse groups (delete membership), then add users would be a good approach. Most likely the developer hasn't invested the time it takes to implement a a delete from group functionality....and he should.

Thank you very much for the info. Is there somewhere we can point him for sample code and best practices for how to add membership and delete membership? We do have a mixed environment with 2003 DCs and a 2008 (R1) DC, so I'm wondering if powershell or at least AD 2008 might have better tools for him to use.Thank youSara

Hi Sara,As your question is more related to scripting, I would suggest you initiate a new thread in our Official Scripting Guys forum for better and accurate answer.The comunity members and supports there are more familiar with scripting. The Official Scripting Guys Forum! http://social.technet.microsoft.com/Forums/en-US/ITCG/threadsRegards,Wilson JiaThis posting is provided "AS IS" with no warranties, and confers no rights.

This looks like a useful resource. Thanks, we'll check it out!