Are you able to use AD Groups for Gallery Admin functionality rather than provisioning individual users? I've read the history and it sounds like this is implemented for collections (which i've tested successfully), but possibly not for Gallery-wide permissions.
