1

Here's the scenario. I have an Windows 2003 Active Directory security group that was created in 2007, and no one remembers what it is for. Is is possible to find out what permissions in our AD implementation are assigned to this group? (Is it controlling folder permissions, is used to delegate user creation, is it doing nothing?)

We're using Windows 2003 as the AD controllers. The AD controllers are also the root DFS servers, but we're using Openfiler to server the actual SMB/CIFS shares.

The group isn't a member of anything, and the only people in the group at part of the IT staff. I tried accesschk from the sysinternals toolset, but it's not being helpful. Are there any other tools I should look at?

2 Answers 2

1

If there are not too many people in that group, just deactivate that group and see what happens. It helps to tell anybody in that group what you are doing, so you can quickly investigate when something doesn't work anymore. Don't do that on your last day before you go on vacation. ;)

The assumption is that you don't user user accounts (from you staff) for automated processes.

1
  • Right. :) That's where I'm at. I just hoped there was a more elegant way then doing a scream test. Thanks for your answer!
    – quinnr
    Dec 30, 2009 at 14:43
1

ShareEnum and AccessEnum would be the tools I'd use to try looking for Share/NTFS permissions related to the group.

http://technet.microsoft.com/en-us/sysinternals/bb897442.aspx

http://technet.microsoft.com/en-us/sysinternals/bb897332.aspx

You should also consider that it's entirely possible that users were added to a security group only for the purpose of placing that group in an OU that has a group policy applied.

GPMC is the quickest way I know of to find out what a group policy actually does.

http://www.microsoft.com/windowsserver2003/gpmc/default.mspx

Sorry if I tend to think outside the box first but we did say "no one remembers what it is for". It's entirely possible that no tool will show what the group is for as the group may exist but the permissions or policy that were applied in the past may have been removed.

3
  • I know what you're talking about, and it's quite handy. I'm looking for something that will walk through AD and report privileges and permissions assigned to AD Objects. I'm surprised MS hasn't written a tool for this. Thanks for the answer.
    – quinnr
    Dec 30, 2009 at 14:39
  • What does GPMC reall have to do with this? Dec 31, 2009 at 8:13
  • What part of "no one remembers what it is for" did you not get. There are MANY possible uses for a group in active directory and not all of them are permissions based.
    – pplrppl
    Dec 31, 2009 at 13:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .