Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

If I have a security group, is there an easy way to see which security policies it is used for? Is there an easy way to cross-reference this information? Perhaps a way to export an entire list of all security policies, with the security group names listed for each?

share|improve this question
3  
If only it were that easy. This is one of those times when you realize why it's so important to effectively document your environment. –  MDMarra Oct 11 '11 at 19:33
add comment

3 Answers

No easy way that I know of. What you could do is document who the members/nested groups are and remove them from the group. If nobody screams, delete the group, otherwise put them back in. Probably not the most political way to go about it, but the fastest way to find things out.

share|improve this answer
add comment

You can easily see what groups the group is a part of, and what users are in the group.
That's where easy stops.

For file systems you can use rudimentrary tools like cacls to list who has permissions, but it is generally a mountain of mostly useless day. You can also use Auditing and Event Log to track down some usage patterns. There are some commercial tools available to make these tasks a bit easier.

None of the above is a substitute for documentations as MarkM mentioned. Best practices and proper documentation are your best bet for keeping Access Controls under control.

share|improve this answer
add comment

I'm not sure what you're referring to when you reference security policies, but I suspect you're referring to file and folder permissions as well as delegation of control.

I can tell you from first hand experience that it's no easy task to manage and keep track of. I work in an environment where there is a very distinct separation between what senior and junior level admins can and cannot do. Junior admins are restricted to managing group policy for a limited set of GPO's, have limited rights to manage a limited number of servers, have limited access to a small set of AD OU's, have limited access to a small number of DNS zones, can shadow TS users but can't themselves log on via TS, etc., etc. The only way to keep track of it is to document it.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.