Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Here's the scenario. I have an Windows 2003 Active Directory security group that was created in 2007, and no one remembers what it is for. Is is possible to find out what permissions in our AD implementation are assigned to this group? (Is it controlling folder permissions, is used to delegate user creation, is it doing nothing?)

We're using Windows 2003 as the AD controllers. The AD controllers are also the root DFS servers, but we're using Openfiler to server the actual SMB/CIFS shares.

The group isn't a member of anything, and the only people in the group at part of the IT staff. I tried accesschk from the sysinternals toolset, but it's not being helpful. Are there any other tools I should look at?

share|improve this question
up vote 1 down vote accepted

If there are not too many people in that group, just deactivate that group and see what happens. It helps to tell anybody in that group what you are doing, so you can quickly investigate when something doesn't work anymore. Don't do that on your last day before you go on vacation. ;)

The assumption is that you don't user user accounts (from you staff) for automated processes.

share|improve this answer
Right. :) That's where I'm at. I just hoped there was a more elegant way then doing a scream test. Thanks for your answer! – quinnr Dec 30 '09 at 14:43

ShareEnum and AccessEnum would be the tools I'd use to try looking for Share/NTFS permissions related to the group.

You should also consider that it's entirely possible that users were added to a security group only for the purpose of placing that group in an OU that has a group policy applied.

GPMC is the quickest way I know of to find out what a group policy actually does.

Sorry if I tend to think outside the box first but we did say "no one remembers what it is for". It's entirely possible that no tool will show what the group is for as the group may exist but the permissions or policy that were applied in the past may have been removed.

share|improve this answer
I know what you're talking about, and it's quite handy. I'm looking for something that will walk through AD and report privileges and permissions assigned to AD Objects. I'm surprised MS hasn't written a tool for this. Thanks for the answer. – quinnr Dec 30 '09 at 14:39
What does GPMC reall have to do with this? – Brian Desmond Dec 31 '09 at 8:13
What part of "no one remembers what it is for" did you not get. There are MANY possible uses for a group in active directory and not all of them are permissions based. – pplrppl Dec 31 '09 at 13:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.