This is hard. Very hard. You could do something like write a script to iterate over a filesystem and evaluate permissions but it would be somewhat cumbersome - you'd have to run it on each server and it may take a long time depending on how many files are on the server.
Look at the group members. Are they primarily a group of people from one department? That may point you in the right direction, and if you have a cryptic group name (e.g HSGD Super Users
where HSGD
is a departmental LOB app) you could ask if it means anything to them.
Check the Notes field of the group to see if it contains anything helpful (hint: that field is VERY useful and I would recommend you use it going forward).
For this to be a thorough check, you're going to have to check other things than filesystem permissions though. Anything that is capable of using Windows permissions will need to be checked, and unfortunately I can guarantee you will forget something (everyone always forgets hardware appliances). Off the top of my head though:
- Filesystem permissions
- SQL Server
- Microsoft Exchange
- Your antivirus software (mainly the server management console, if applicable)
- Scheduled Tasks
- Windows Services
- Active Directory delegated permissions
- Permissions granted on individual workstations for a particular AD user/group
- Backup software logon accounts
- Hardware appliances (authenticates using an AD account)
- Linux machines/services (similarly, a service running on them may use LDAP and authenticate with a dedicated account)
- Any and all LOB apps you use
I should also call out something very important, which is you shouldn't forget a users indirect group memberships from nested groups. Believe me, that's a real kicker - I've done it before.
Finally, I was being somewhat flippant when I said this in a comment to your question, so make what you will of this bit of advice. If you've got a group you want to delete, make a note of the group members and simply take them all out of the group. It's important you don't immediately delete the group because if this group has permissions granted all over the place and you cause serious breakage you will want to quickly fix it by adding everyone back in. If you delete the group, you first have to figure out where the permissions are granted (which you don't know) and apply the exact same permissions as before, which may not be default permissions (again, which you don't know).
$Thing
isn't working any more? :-)