AD Groups

Last updated: September 15, 2022
Audience: IT Staff / Technical

Status

This feature is in limited pilot and is not generally available yet. At this time, UW-IT is making use of this feature to enable key capabilities which are blocked otherwise. In the future, we will enable delegated OU customers to also leverage this capability.

Intended purpose

AD Groups are intended for customers who need to programmatically manage groups within the Microsoft ecosystem, for those needs which are not met by the UW Groups Service.

This solution provides a variety of very well-known management mechanisms and the highly available infrastructure of Active Directory, and syncs these groups to Azure Active Directory for use with various Azure services. These groups are not intended to be part of the UW Groups service ecosystem and thus are not synchronized with UW Groups, though they may have UW Groups as members with certain limitations on functionality in Azure.

Comparison of UW Groups Service to AD Groups

Desired Feature UW Groups Service AD Groups
Reusable group across non-Microsoft technologies (tick) (error)
Off-the-shelf group management integration (error) (plus)
Group in the u_ or uw_ namespace (tick) (error)
Ability to sub-delegate management of groups (tick) (error)
Membership dependency1 (tick) (minus)
Effective membership2 (tick) (minus)
Group history (tick) (error)
Opt-in or out group membership (tick) (error)
Membership viewer controls (tick) (error)
Scalable & performant group edits (minus) (plus)
Can have UW Groups as members (tick) (tick)
Can have AD users as members (tick) (tick)
Can have AD computers as members (tick) (tick)
Can have other AD Groups as members (error) (tick)
Works in AAD/O365 (tick)(question) (tick)(question)

Symbols reference

Symbol
Meaning
(plus) Great or recommended
(tick) OK or Yes
(minus) Some issues
(error) Not recommended, discouraged, or No
(question) Unclear; may depend on the scenario

Footnotes for the Table

1 For AD Groups: a script using a variation on:
diff (Get-ADGroupMember “Group 1”) (Get-ADGroupMember “Group 2”) -Property ‘SamAccountName’ -IncludeEqual 

would give you membership dependency

2 For AD Groups: a script with:

(get-adgroupmember -Recursive -Identity ad_mygroup).SamAccountName

will give you effective membership

Planned Approach for General Availability

Each delegated OU can get its own Group OU within the NETID Active Directory at ou=<delou>,ou=delegated,ou=groups,dc=netid,dc=washington,dc=edu. The ability to create & manage groups within a Group OU will be delegated to u_msinf_delou_<delou>_groupadmins, a new OU role group for each delegated OU, with initial membership populated from u_msinf_delou_<delou>_ouadmins.

The namespace for each Delegated OU’s AD Groups is ad_<delou>_<groupname>. We strongly recommend using a naming structure similar to what is used for UW Groups.

Some example AD Group names:
ad_pottery_computers
ad_pottery_lab200_users

The ability to create groups with a name outside the designated namespace can not be prevented by technical controls, but violations will be automatically removed.