- 5 minutes to read

Windows AD Group Overview

Get started now: How to Add or manage Windows AD Group user guide.

The Windows AD Group Overview in the Access Management main menu is where a Nodinite Administrator manages Windows AD Groups: the Active Directory security groups whose members get the permissions of one or more Roles.

Windows AD Groups are part of the role-based Access Management model in Windows authentication mode, together with individual Users. In OIDC/OAuth 2.0 mode, Claims and Policies take their place. Read 'What is a Windows AD Group?' first to understand the concept and its prerequisites.

  • ✅ Centralized management of Windows AD Groups
  • ✅ Enforce secure, role-based access rights
  • ✅ Streamline administration for large environments
  • ✅ Gain a helicopter perspective on who has access through which group

Understanding Windows AD Groups in Access Management

A Windows AD Group links an Active Directory security group to Nodinite Roles. The Roles carry the permission sets that decide what members see in the Web Client.

flowchart LR AD["fa:fa-users Active Directory<br/>security group"] -->|"added as"| WG["fab:fa-windows Windows AD Group"] WG -->|"member of"| R["fa:fa-users-class Role"] R -->|"Permission Set"| LV["fa:fa-search Log Views"] R -->|"Permission Set"| MV["fa:fa-display Monitor Views"] R -->|"Permission Set"| RM["fa:fa-sitemap Repository Model<br/>and C4 Diagram Sets"] style AD fill:#9E59BB,color:#fff style WG fill:#2678BD,color:#fff style R fill:#E47528,color:#fff style LV fill:#3F827B,color:#fff style MV fill:#3F827B,color:#fff style RM fill:#3F827B,color:#fff

Purple: the external Active Directory group; blue: the Windows AD Group you manage on this page; orange: the Role it is a member of; teal: the permission sets the Role grants.

Component Role in access control Managed in
Active Directory security group Holds the members; join or leave to gain or lose access Active Directory
Windows AD Group Registers the group (DOMAIN\GroupName) in Nodinite This page
Role Groups permission sets; a Windows AD Group can be a member of many Roles Roles Overview
Permission sets Log Views, Monitor Views, Repository Model, C4 Diagram Sets Add or manage Role

The feature is controlled by the UseActiveDirectoryGroups System Parameter (default true).

The Windows AD Groups List

In the Windows AD Group Overview you find a sortable list of defined Windows AD Groups. Narrow down an extensive list by typing characters into the filter text box.

Windows AD Groups list with the filter box, Include deleted checkbox, Add Windows AD Group button, Name and Description columns, and an Action button per group (7.10)
Each group is listed by its domain-qualified name; a dot as the domain marks a local group. Sort by Name, Created, Changed, or Description.

Manage Windows AD Group

The available functionalities for managing the Windows AD Group are:

Add new Windows AD Group

To create a new Windows AD Group, click the "Add Windows AD Group" button to open the Windows AD Group editor.

Add Windows AD Group button in the Windows AD Groups list
The 'Add Windows AD Group' button opens an empty Windows AD Group form.

Edit Windows AD Group

To Edit an existing Windows AD Group, click the link in the Name column, or open the menu from the "Action" button and click the "Edit" menu item.

Action menu with Edit highlighted above Show in Mapify, Show in Mermaid, and Delete (7.10)
Example from the Roles list; the Windows AD Group Action menu uses the same Edit, Delete, and Restore items.

Delete Windows AD Group

To Delete an existing Windows AD Group, open the menu from the "Action" button and click the "Delete" menu item. Deleted groups can be restored (see below).

Action menu with Delete highlighted at the bottom (7.10)
A deleted Windows AD Group is kept and can be restored.

Restore deleted Windows AD Group

To Restore a deleted Windows AD Group, first check the "Include deleted Windows AD Groups" checkbox.

When checked, deleted Windows AD Groups are included in the list.

Then open the menu from the "Action" button and click the "Restore" menu item.

Action menu on a deleted item with Restore highlighted in place of Delete (7.10)
Restore appears instead of Delete only on deleted items.

Export Windows AD Group

The Action menu has no Export item (7.10). To move Windows AD Groups to another Nodinite instance, use the Web API; the Import/Export tool is disabled in Nodinite 7.x.

Copy API URI

From the "Copy API URI" modal you get the underlying REST API call that was made against the Web API. Click "Copy API URI" to open the modal and get the query string.

Nodinite promotes the use of custom Reports.

Frequently asked questions / Troubleshooting

You can create new, edit, and delete Windows AD Groups using the Nodinite Web Client. More answers are in the Access Management Troubleshooting guide.

How do I create a new Windows AD Group?

Read and follow the instructions in this user guide: 'Add or manage Windows AD Group'.

Why can't I see the Windows AD Groups menu item?

Windows AD Groups belong to Windows authentication mode, and the UseActiveDirectoryGroups System Parameter must be true. In OIDC/OAuth 2.0 mode, use Claims and Policies instead; to switch, see Migrate Authentication Method.

Who changed a Windows AD Group?

Changes are recorded in the Log Audit Search.

Next Steps