Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Here's the scenario. I have an Windows 2003 Active Directory security group that was created in 2007, and no one remembers what it is for. Is is possible to find out what permissions in our AD implementation are assigned to this group? (Is it controlling folder permissions, is used to delegate user creation, is it doing nothing?)

We're using Windows 2003 as the AD controllers. The AD controllers are also the root DFS servers, but we're using Openfiler to server the actual SMB/CIFS shares.

The group isn't a member of anything, and the only people in the group at part of the IT staff. I tried accesschk from the sysinternals toolset, but it's not being helpful. Are there any other tools I should look at?

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

If there are not too many people in that group, just deactivate that group and see what happens. It helps to tell anybody in that group what you are doing, so you can quickly investigate when something doesn't work anymore. Don't do that on your last day before you go on vacation. ;)

The assumption is that you don't user user accounts (from you staff) for automated processes.

share|improve this answer
    
Right. :) That's where I'm at. I just hoped there was a more elegant way then doing a scream test. Thanks for your answer! –  quinnr Dec 30 '09 at 14:43
add comment

ShareEnum and AccessEnum would be the tools I'd use to try looking for Share/NTFS permissions related to the group.

http://technet.microsoft.com/en-us/sysinternals/bb897442.aspx

http://technet.microsoft.com/en-us/sysinternals/bb897332.aspx

You should also consider that it's entirely possible that users were added to a security group only for the purpose of placing that group in an OU that has a group policy applied.

GPMC is the quickest way I know of to find out what a group policy actually does.

http://www.microsoft.com/windowsserver2003/gpmc/default.mspx

Sorry if I tend to think outside the box first but we did say "no one remembers what it is for". It's entirely possible that no tool will show what the group is for as the group may exist but the permissions or policy that were applied in the past may have been removed.

share|improve this answer
    
I know what you're talking about, and it's quite handy. I'm looking for something that will walk through AD and report privileges and permissions assigned to AD Objects. I'm surprised MS hasn't written a tool for this. Thanks for the answer. –  quinnr Dec 30 '09 at 14:39
    
What does GPMC reall have to do with this? –  Brian Desmond Dec 31 '09 at 8:13
    
What part of "no one remembers what it is for" did you not get. There are MANY possible uses for a group in active directory and not all of them are permissions based. –  pplrppl Dec 31 '09 at 13:59
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.