We have some sloppily created groups on our AD backend. We had a couple domains that were merged, and wound up with similar groups..

"Financial Aid" "financialaid" "FA"

etc... I want to consolidate these groups, without breaking everyone's network access.

Some folders were rganted permissions to one group, or another, and I'd like to do a global "find and replace permissions" sweep of folders on certain shares.


folder1 has full access to "Financial Aid"
folder2 has read for "FA"

I'd like to either make a new group:

folder1 has full access for "Financial_Aid"
folder2 has read for "Financial_Aid"

...or just "merge" one group into another:

folder1 has full access for "Financial Aid"
folder2 has read for "Financial Aid"

Any pointers? Not afraid to dig around in powershell or python, just curious if anyone has relevant links of seeing this done, and gotchas to watch out for...


Unfortunately, you're probably going to have to do a lot of this manually. File-system permissions and network-share permissions only store the SID of the group and the assigned permissions locally. The domain-controllers only tell servers who is in what group... and verify that a user is who they say they are.

What that means... is that you'll have to make permissions changes to EACH server directly... You might be able to script a lot of it using the command-line tool "cacls" for file-system permissions... and the "net share" commands to adjust share permissions... but ultimately, this is 100% less than ideal... and may end-up giving too many permissions to the wrong people.

Wouldn't now be a good time to start fresh and setup a new clean group... and put the appropriate users in those groups... and set sweeping permissions on the appropriate shares & files? That way, you can completely eliminate the "is betty-sue supposed to be able to access the Dean's personal documents" type situations.

| improve this answer | |
  • that's pretty much what I figured... that it will likely just require some bold, sweeping readjustments from the top down, and then a bunch of little tweaks here and there to iron out the kinks. – Ixobelle Sep 1 '11 at 15:40

How about this. Create a third group and put all the employees in it. Add that group to the two old ones and remove all user accounts from the group. Now you have one group to go to to add remove users. Then, over time, remove the old groups from the permissions and replace with the new group.

FWIW, we create multiple groups for each share (share_read, share_write, share_admin). Spend a lot of time up front figuring out what to do before starting.

As for how to create that third group, Powershell v2 and the AD cmdlets is really the technology to use. If you have Win2k3 DCs, add the AD Web service to your network. If you have Win2k8 DCs you can use them directly.

| improve this answer | |
  • the problem is that we don't know when it's finally safe to kill off the poorly named "other, earlier groups". Eventually, we'll need to just flip that switch, which is why I was hoping to merge them. Thanks for the feedback, though. – Ixobelle Sep 1 '11 at 15:41
  • We take the approach of doing as much work up front as we can. Then we choose a day to implement, let the support folks know and listen for screams. If we can't resolve the screams quick enough, we put it back (if possible) – uSlackr Sep 2 '11 at 19:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.