Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

You just got hired at company A and the old administrator is no longer there. Requests start coming through for adding users to the internet restrict group. When you look at the groups none of the names make sense and there is no documentation out there to explain what each group has rights to and what it does. That would raise concern to me. For security how do you know if everyone has the correct rights.

How would you discover what the groups have rights to? Is there a tool out there that will find this information for you?

share|improve this question
You might be looking at the wrong layer/area of information. Internet related restrictions may be defined elsewhere? There are AD tools that show you summaries (or final results of) of your GPO constellation per user or user-group. I used this in the past to diagnose trouble with restricted 'terminal server' users. I'm sure somebody else here will remember of the top of their head, mine limited skull is full of postgreSQL & sendmail at the moment :-P – DutchUncle Jun 13 '11 at 17:01
I was just using that as an example. I need to find out about how to see what groups has rights to in AD – user84414 Jun 13 '11 at 17:08

You don't. There's so many things, you essentially can't do it unless you already know the entire environment anyway. See : How can I check access of a Group/User in AD before I delete it?

Look at Ben Pilbrow's answer for a partial list of the things that an entity in AD can be given rights to. If you know every application in your environment that can have an AD entity get an ACL assigned to it, then you can query each of them for every ACL.

share|improve this answer

The sysinternals tool, AccessEnum, may be able to help you. It provides the Read, Write, and Denied permissions for each directory in a specific path. Its a very useful tool, but you should note, that its output is also very verbose.

There is also accesschk. You can use it to display particular access information for a specific user against a specific directory and its files.

share|improve this answer
That's only for filesystems. There's AD itself, there's SharePoint, there's SQL, there's a dozen other things just from Microsoft, let alone any other apps that can query AD. – mfinni Jun 13 '11 at 18:17
That said, it's a great answer for looking at filesystems. – mfinni Jun 13 '11 at 18:39

Active directory is an authentication and directory service provider. It contains only permissions that pertain to active directory itself (eg can yuo raed the members of this group, can you modify this user etc). Using active directory alone it is impossible to determine what a group or user is actually used for. Yuo are right to be worried about the security aspect. yuo aer now in a situation where you can be socially engineered into giving someone access to something they should not have. In this situatio ni would probably start by running some sort of auditing, either windows native or a tool like quest access manager, in order to start guess who owns what. After you've spent quality time with those reports, you can start pruning groups down (see my answer here for a suggested methodology. While doing this save yoorself some future headaches by:

  • Use the Managed By field
  • fill in a description that tells you specifically Why this group exists (eg "used for the super cool
    sharepoint server")
  • use the notes field for special handling instructions ( eg "JimB's team owns this group and all membership requests must be handled by them - do not make this a universal group as it will break some ldap lookups")
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.