Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are doing some AD clean up and migrating or deleting old AD groups and replacing them with our current naming stranded in AD. The challenge that we are running into is making sure we have the we have found all of the places with the previous group was used throughout the network specifically for file and folder access. for example let say we have an AD group called "old-Group" that is giving NTFS permissions on 4 different folder on 3 different servers. Is there a tool or script that I can install/run to identify all of the places where "old-Group" is listed in the permissions.

share|improve this question

Possible duplicate: How do I find out how an Active Directory group is being used?

However, see the below Technet Forum article with links, etc. that might help:

How to tell if Active Directory group is used anywhere

share|improve this answer

This is an important problem that is faced by admins in many environments. Unfortunately, it is not an easy problem to solve because in order to do so, one needs to scan every share / directory on every machine in the network and that is not easy task by any means.

For instance, imagine a scenario where you have 1000s of machines. Can you imagine how much effort must go into to scan each machine and roll this information up. It would also take a lot of time to do, by which point the information itself runs the risk of being stale.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.