SQL Server Active Directory login groups with limitation I'm DBA in my organization and use SQL Server 2012 and 2014. I requestd to define multiple group in active directory such as Developer, DBA, supporter and ets... and add my users to this groups. after this a create login from this groups and grant access to DBA, Developer and supporter groups. Change in my organization chart is above, and each time one personnel changed his position, I request to change his group in Active Directory.

My problem: The Admin of Active Directory can add his user or any user to each of this groups and get access to my database without that I get it.

I want to use this groups for grant permission and looked up for a way for solve my problem.

Thanks in advance.
This is a common issue, you want to use groups to keep things simple but you don't want to lose visibility of who has access to your databases. The way I see it you have two options:


If you trust your AD admins (If you don't you have bigger problems) then use AD groups.
If you don't trust your AD admins then you will have to manage access on a per user level by giving everyone an individual SQL Server login.