Reverse lookup of security policies from security group?

Question

If I have a security group, is there an easy way to see which security policies it is used for? Is there an easy way to cross-reference this information? Perhaps a way to export an entire list of all security policies, with the security group names listed for each?

Answer 1

No easy way that I know of. What you could do is document who the members/nested groups are and remove them from the group. If nobody screams, delete the group, otherwise put them back in. Probably not the most political way to go about it, but the fastest way to find things out.

Answer 2

You can easily see what groups the group is a part of, and what users are in the group.
That's where easy stops.

For file systems you can use rudimentrary tools like cacls to list who has permissions, but it is generally a mountain of mostly useless day. You can also use Auditing and Event Log to track down some usage patterns. There are some commercial tools available to make these tasks a bit easier.

None of the above is a substitute for documentations as MarkM mentioned. Best practices and proper documentation are your best bet for keeping Access Controls under control.

Answer 3

I'm not sure what you're referring to when you reference security policies, but I suspect you're referring to file and folder permissions as well as delegation of control.

I can tell you from first hand experience that it's no easy task to manage and keep track of. I work in an environment where there is a very distinct separation between what senior and junior level admins can and cannot do. Junior admins are restricted to managing group policy for a limited set of GPO's, have limited rights to manage a limited number of servers, have limited access to a small set of AD OU's, have limited access to a small number of DNS zones, can shadow TS users but can't themselves log on via TS, etc., etc. The only way to keep track of it is to document it.