Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The question is pretty simple. Is there any way to get the number of users on an Active Directory with a specific Group policy applied?

For example, i need to know how many users has the strong password policy applied and i can't access computer by computer to check it.

share|improve this question
    
If you have to ask, the answer is probably all of them or none of them. There's a lot of confusion around fine-grained password policies, and most organizations that thought they were setting different password policies for different groups weren't actually doing so. –  HopelessN00b Nov 8 '12 at 17:13
    
The question is: the admin sais something and i need to prove if the statement is correcto so, i need to check on an LDAP query or something like that –  Pelirrojilla Nov 9 '12 at 10:02

1 Answer 1

I'll address this in two sections, since password policies are handled differently than most other GPO settings.


For example, i need to know how many users has the strong password policy applied and i can't access computer by computer to check it.

If you're not using Fine Grained Password Policies, then all of your users will have the same password policy.

If you are using Fine Grained Password Policies, then you have to define a specific user or group to apply that policy to, so just count who is in that group.

You can use a combination of Get-ADGroupMember and Measure-Object in PowerShell if there are too many to count by hand or you want to automate it, for some reason.


Is there any way to get the number of users on an Active Directory with a specific Group policy applied?

Group policies apply to users or computers and are linked to domains, sites, and OUs. Simple check where the the policy that you're curious about is linked to, and then count everything that it applies to within that domain, site, or OU. The Measure-Object PowerShell cmdlet is your friend here.

share|improve this answer
    
For the latter question, he'll also need to account for any blocked inheritance (resets to 0 so start from a fresh slate as you descend) or WMI filtering, which might be somewhat tough. Also, any "read deny" permissions on any individual GPO would prevent them from applying as well, to the users/groups being denied. –  mfinni Nov 8 '12 at 17:57
2  
@mfinni All very true. Maybe I should shorten the answer to "Figure out what the GPO is applying to and count" :) –  MDMarra Nov 8 '12 at 18:04
    
Hello guys, thanks for the responses. I'm auditing an active directory so i need to check every time the users with the policies applied. Isn't there any other way to automatically check? –  Pelirrojilla Nov 9 '12 at 9:36
    
You can monitor the event logs on all of the machines –  MDMarra Nov 9 '12 at 11:26
    
sure @MDMarra but we license the SIEM solution by machine monitored so, it's too much expensive. I've found GPInventory but i'm not sure if it works with WS2008 AD –  Pelirrojilla Nov 9 '12 at 12:31

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.