Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The current company I work for used to use Microsoft CRM , this was before I came. It was also removed before I came, however our current active directory contains a CRM category with tons of security groups etc.

No one and nothing seems to be connected to these groups

What is the risk involved in removing these left over entries? I have been told not to, but I don't like them for some reason.

share|improve this question
up vote 1 down vote accepted

If the security groups in these OUs are named like

PrivReportingGroup {GUID}
PrivUserGroup {GUID}
ReportingGroup {GUID}
SQLAccessGroup {GUID}
UserGroup {GUID}

and the CRM System is not existing anymore you can safely remove them. These groups are used by Dynamics CRM to manage application and user security.

See the list of Microsoft Dynamics CRM Server installed configuration components for reference. In order to remove the remains manually see How to manually remove the Microsoft Dynamics CRM 4.0 server

share|improve this answer
thanks for the help! – Jeff Apr 12 '11 at 20:04
to be honest, this CRM system has been gone for over 5 years. I have removed almost all of the security groups under the main CRM OU, and nothing has broken. so I am contemplating just removing the entire CRM OU and subitems from the AD. We built our own inhouse CRM in .net that is used in the company, and does not use AD for anything – Jeff Apr 14 '11 at 16:14
@Jeff sure, in this case you could remove the entire OU without any problems – ccellar May 26 '11 at 13:58

I think you mean there is an OU in AD that has all of these security groups in it. If that's the case and you want to get rid of it, I would just remove the access on that OU so only administrator have access and see if anyone yells. If all is quiet for a few weeks, you can go ahead and delete it.

I wouldn't just go deleting it though without knowing for sure if anything will break. AD object level restore is not a very fun task.

share|improve this answer
I second this. What you hope to do shouldn't cause any issues. The only way you will suffer ill effects from this is if these groups were used improperly to assign/deny rights to non-CRM related roles. – pk. Mar 23 '11 at 18:31
thanks, ou* is what i meant, sorry – Jeff Mar 23 '11 at 19:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.