ArcGIS Server Manager security and adding users as groups

[DaveAugspurger]

In ArcGIS Server Manger--->Security-->Users:

I want to add an existing Windows Domain "Group" rather than individual Users.  Is this possible?

My configuration is:
User Store: Windows Domain
Role Store: ArcGIS Server Built-in
Authentication Tier: GIS Server
Authentication Mode: ArcGIS Tokens

[StephanieSnider]

I was not successful setting up Windows domain roles in ArcGIS Server 10.0.  The Windows groups that ArcGIS Server listed were not the same as the Active Directory groups I wanted to select.  We ended up using the option for "users from Windows�?� and �??roles from ArcGIS Server�?�.  This setup ended up being the best option since our GIS group does not have permission to add/remove users from a group in active directory, but we can create our own role in ArcGIS Server and add any windows users we want to that group.

[StephanieSnider]

I wanted to do this too, but ArcGIS Server does not list the active directory groups, only the individual users.  We have to add the Windows domain users into an ArcGIS Server role - one at a time.

[AlexeyTereshenkov]

Stephanie, you should probably be able to achieve this by using the ArcGIS Server Administrator Directory API with a scripting language - http://resources.arcgis.com/en/help/main/10.1/index.html#/Scripting_with_the_ArcGIS_Server_Administr....

[TysonHaverkort]

Are there plans to add support for AD Groups in the Identity Store?  We have a large number (more than 40,000) user accounts in the system, and these have been sorted into thousands of AD groups by IS.  I'd like to take advantage of that.

If I have to, I'll script it (assuming the Server Admin API supports adding AD Groups to roles - I didn't see any examples of even adding AD Users to a Role), but really this should be included in the software.

Thanks,
Tyson

[SallyEdwards]

I also  want to add Windows Domain Groups to Roles but can only see Users in the list.
Did anyone find out if there are any plans to enable ArcGIS Server to work with Windows domain Groups rather than just individual users.
I don't see the point in having to manage lots of users that our Active Directory already has set up in a group.

Thanks
Sally