3

You just got hired at company A and the old administrator is no longer there. Requests start coming through for adding users to the internet restrict group. When you look at the groups none of the names make sense and there is no documentation out there to explain what each group has rights to and what it does. That would raise concern to me. For security how do you know if everyone has the correct rights.

How would you discover what the groups have rights to? Is there a tool out there that will find this information for you?

2
  • 1
    You might be looking at the wrong layer/area of information. Internet related restrictions may be defined elsewhere? There are AD tools that show you summaries (or final results of) of your GPO constellation per user or user-group. I used this in the past to diagnose trouble with restricted 'terminal server' users. I'm sure somebody else here will remember of the top of their head, mine limited skull is full of postgreSQL & sendmail at the moment :-P
    – DutchUncle
    Jun 13, 2011 at 17:01
  • I was just using that as an example. I need to find out about how to see what groups has rights to in AD
    – user84414
    Jun 13, 2011 at 17:08

3 Answers 3

2

You don't. There's so many things, you essentially can't do it unless you already know the entire environment anyway. See : How can I check access of a Group/User in AD before I delete it?

Look at Ben Pilbrow's answer for a partial list of the things that an entity in AD can be given rights to. If you know every application in your environment that can have an AD entity get an ACL assigned to it, then you can query each of them for every ACL.

1

The sysinternals tool, AccessEnum, may be able to help you. It provides the Read, Write, and Denied permissions for each directory in a specific path. Its a very useful tool, but you should note, that its output is also very verbose.

http://technet.microsoft.com/en-us/sysinternals/bb897332

There is also accesschk. You can use it to display particular access information for a specific user against a specific directory and its files.

http://technet.microsoft.com/en-us/sysinternals/bb664922

2
  • That's only for filesystems. There's AD itself, there's SharePoint, there's SQL, there's a dozen other things just from Microsoft, let alone any other apps that can query AD.
    – mfinni
    Jun 13, 2011 at 18:17
  • That said, it's a great answer for looking at filesystems.
    – mfinni
    Jun 13, 2011 at 18:39
1

Active directory is an authentication and directory service provider. It contains only permissions that pertain to active directory itself (eg can yuo raed the members of this group, can you modify this user etc). Using active directory alone it is impossible to determine what a group or user is actually used for. Yuo are right to be worried about the security aspect. yuo aer now in a situation where you can be socially engineered into giving someone access to something they should not have. In this situatio ni would probably start by running some sort of auditing, either windows native or a tool like quest access manager, in order to start guess who owns what. After you've spent quality time with those reports, you can start pruning groups down (see my answer here for a suggested methodology. While doing this save yoorself some future headaches by:

  • Use the Managed By field
  • fill in a description that tells you specifically Why this group exists (eg "used for the super cool
    sharepoint server")
  • use the notes field for special handling instructions ( eg "JimB's team owns this group and all membership requests must be handled by them - do not make this a universal group as it will break some ldap lookups")

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .