ControlPoint 8.7 - User Guide

Managing SharePoint Groups

ControlPoint Manage SharePoint Groups is a farm-level action that lets you propagate the permissions and membership of a SharePoint group on one site with groups on one or more different sites in the same farm.  You can either:

·overwrite the membership and permissions of an existing group (but retain the group's name)

EXCEPTION:  Permissions of a group within a list, folder, or item that has unique (non-inherited) permissions will not be changed.

OR

·create a new group with the same name, membership, and permissions as the model group.

ControlPoint Group Management Terminology

Association - The relationship between the SharePoint group whose permissions and membership you want to propagate and all of the groups to which you want to propagate them.

Model Group -The SharePoint group whose permissions and membership you want to propagate.

Dependent Group(s) -  The SharePoint group(s) to which you are propagating the membership and permissions of the model group.  You "adopt" a new dependent group when you add it to an association.

Synchronize - The act of propagating permissions and membership of a model group to its dependent groups.  Whenever you synchronize groups within an association, the existing permissions and/or membership of dependent groups are overwritten with those of the model group.

NOTE:  Synchronization is a one-way process (that is, model to dependents only).  Although changes to model groups are not automatically propagated to dependent groups, you can schedule a synchronization to run on a regular basis to ensure that model and dependent groups remain in sync.  You can choose to synchronize the permissions of the model group only, the group's membership only, or both permissions and membership.

In a multi-farm environment, SharePoint groups can be managed for a single farm; either the home farm or a remote farm.

To access the Manage SharePoint Groups workspace:

From the farm or Web Application level of the SharePoint Hierarchy, choose Automation > Manage SharePoint Groups.  

The top grid lists all existing associations with the following information:

·the Association Name

·a link that enables you to Edit the Association Name.

·the model Group Name

·the Group Description (as specified in SharePoint Group Settings page)

·the Site Name and Site URL where the model group resides

·Permissions associated with the group

·the # of Users with Permissions for the group

·a Details link that lets you open the SharePoint People and Groups page for the model group.

When you select a group in the top grid, the bottom grid lists all of the dependent groups in the association, along with the following information:

·the dependent Group Name

·the Site Name and Site URL where the dependent group resides

·the Adoption Date (that is, the date the dependent group was added to the association)

·a View Details link that lets you open the SharePoint People and Groups page for the dependent group.

Now you can:

·Associate a SharePoint Group from One Site with Other Sites

·Maintain SharePoint Group Associations

·Dissolve Group Associations and/or Delete SharePoint Groups.

Associating a SharePoint Group from One Site with Other Sites

Factors to Consider Before Associating Groups

·A group can be a member of only one association; either as a model or a dependent.

·A dependent group cannot be created on a site that inherits permissions from its parent.

·If the permission level of the model group does not exist in the target site collection, it will be created there.  

·If the owner of the model group is either a valid "user" or a SharePoint group that exists in the target site collection, that user or group will become the owner of the dependent group.  If the owner is not a valid user (for example, a SharePoint group or built-in account such as SharePoint\system or NT AUTHORITY\authenticated users) or is a SharePoint group that does not exist in the target site collection, the user requesting the action will become the owner of the dependent group.

EXCEPTION:  If the dependent group already exists in the target location (that is, you are not creating a new group), group ownership will remain unchanged.

To create a new association:

1From the Group Management workspace, click [Create New Association] to display the model group picker.

NOTE:  By default, the left side of the picker includes Web Applications within the selected scope.  You can, however, check the Expand Scope box to include all Web Applications within the farm.

2Use the information in the table below to determine the appropriate action to take.

3Click [Create Association].

The model group displays in the grid at the top of the workspace with the following information:

§Association Name (This is, by default, the name of the model group.  You can, however click the Edit Assoc. Name Edit link and specify a different name.)

§Group Name and Group Description (as specified on the SharePoint Group Settings page)

§Site Name and Site URL

§Permissions level(s)

§# Users in the group.

To open the SharePoint People and Groups page for the group, click the View link in the Details column.

4Scroll to the bottom of the workspace.

5Click [Adopt New Dependents] to display the dependent group picker.

6Use the information in the following table to determine the appropriate action to take.

NOTE: By default, the left side of the picker includes Web Applications within the selected scope.  You can, however, check the Expend Scope box to include all Web Applications within the farm.   If you want to associate a dependent group in a newly-created site, it may take several minutes for the site to appear in the picker.  

7Click [Apply].

By default, both group membership and permissions are synchronized. However, if you want to synchronize only permissions or membership, uncheck the other option.

Now you can either:

·synchronize model and dependent group(s) immediately, (by clicking [Synchronize])

OR

·complete the Schedule Synchronization section and schedule the synchronization to run at a later time or on a recurring basis.

TIP:  Schedule the synchronization to run on a recurring basis if you want to ensure that groups remain in sync.

Maintaining SharePoint Group Associations

Synchronizing Associated SharePoint Groups

When you create a new association, the membership and site-level permissions associated with the model group are copied to the dependent group(s) as part of the operation.  To copy future changes to group membership or permissions, you must synchronize the model group with its dependents.  

TIP:  You can run a synchronization on a regular schedule, to ensure that groups remain in sync.

Synchronization applies to an entire association (that is, any changes to the model group will be propagated to all dependents in the association).  Keep in mind that that, when you synchronize an association, any changes that have been made directly to a dependent group will be overwritten.

To synchronize associated groups:

1In the Group Management workspace, highlight the model group (in the top grid) whose dependents you want to synchronize.

2Either

§synchronize groups immediately, by clicking the [Synchronize] button

OR

§schedule the synchronization to run at a later time and/or on a regular schedule.

NOTE:  You can only synchronize (or schedule a synchronization for) one association at a time, and you cannot schedule a synchronization for a newly-created site until ControlPoint Discovery has been run.

Dissolving Group Associations and Deleting SharePoint Groups

You can:

·dissolve an association, and either:

§retain the model and dependent groups in their respective SharePoint sites

OR

§delete the model group and all of its dependents from their respective SharePoint sites

·disconnect one or more dependent group(s) from an association, and either:

§retain the group in the SharePoint site

OR

§delete the group from SharePoint.

To dissolve an association and retain model and dependent groups in SharePoint

1In the Manage SharePoint Groups association (upper) grid, highlight the association that you want to dissolve.

2Click [Dissolve Association].

Both the association model and dependent groups are:

·removed from the grids

·retained in their respective SharePoint sites.

To dissolve an association and delete model and dependent groups from SharePoint

1In the Manage SharePoint Groups association (upper) grid, highlight the association that you want to dissolve.

2Click [Delete Association and Groups].

Both the association model and dependent groups are

·removed from the grids

·removed from their respective SharePoint sites.

To disconnect dependent groups from an association and retain the groups in SharePoint:

1In the Manage SharePoint Groups association (upper) grid, highlight the association from which you want to disconnect dependent group(s).

2In the dependent (lower) grid, highlight the group(s) that you want to disconnect.

3Click [Disconnect Selection].

The selected dependent groups are:

·removed from the grid, and

·retained in SharePoint sites.

To disconnect dependent groups from an association and delete them from SharePoint:

1In the Manage SharePoint Groups association (upper) grid, highlight the association from which you want to disconnect dependent group(s).

2In the dependent (lower) grid, highlight the dependent group(s) that you want to disconnect.

3Click [Delete Selection].

The selected dependent groups are:

·removed from the Group Management grid, and

·removed from SharePoint sites.