If I have a situation where there is inappropriate use of security and distribution groups against file shares, and very liberal permissions, what would be the best way to go about handling it?

Are there any industry recognized tools I could use to clean up dormant/lingering/unused objects and manage permissions more efficiently? I'd like a few suggestions.

Is there such a thing as an Active Directory governance document? Any links mightily appreciated.

I have got too many nested groups, up to four levels deep, what do I do about it?

Finally, I have got just too many Group Policies in AD. Are there any other application delivery methods available?

  • Interesting... I have just been saddled with a similar problem (take-over of other company with no governance to speak of) and I looking for the same sort of advice... – Tonny Mar 15 '13 at 16:02
  • @tonny Hire a consultant. Or at least a contractor. It's a heavy workload, and having someone around who's done it before is a huge help, as are any extra hands you can find. Tools that output information at you only go so far, and you still need a lot of mind power to figure out what to do with the information, as well as a lot of effort to actually implement your changes without taking the environment offline or completely changing the user experience. – HopelessN00b Mar 15 '13 at 16:11
  • @HopelessN00b My first idea as well, but the financial managers went berserk at the suggestion. I have to do it in-house. I have been given a year for the project and I can migrate all data to other file-servers (current ones are 6+ years old) so I'm thinking I will separate (old) permissions and data completely: define a new folder/permission structure and share by share migrate the data into the new structure. Won't even attempt to migrate existing permissions/structure. Just throw it away after the data is moved. – Tonny Mar 15 '13 at 16:23
  • @Tonny Yeah, throwing away the old structure is usually the way to go, especially when it's gotten bad enough to warrant building a new domain. That said, you'll generally want thorough reporting on the old permissions to help inform who needs what access, and you generally need to interface with all the other departments and business units to flesh that out as well. It sucks, but it's the only way to avoid the shit storm of Everything's broken!!! you get when users don't have the same access they did before. – HopelessN00b Mar 15 '13 at 16:48
  • @HopelessN00b I have a bit of luck here. Mother company has a very well structured security/role model and associated policies which is reflected in the file-server storage structures too. As the new company needs to be integrated into this it is expected that they restructure their operation to fit the model. When properly done a person that gets his/her new role assigned will automatically also get the proper permissions to do his/her job. Normally this works for about 95% of users. For the other 5% some fine-tuning is needed or define a new role covering their needs. – Tonny Mar 15 '13 at 19:07

Nope. On all counts, really.

A large, well-known multi-national where I live, for example, has in excess of 25,000 GPOs. So, while you may think you have too many GPOs and too much complexity (and you may well), this is not a problem that's really solvable. Large, complex organizations with complex relationships have large, complex directories. No way around it.

The only real solution is proper design, enforcement and administration of your AD structure... which is also not an easy task, or something that's solvable with "a few tools." And, again, even with proper deign and policies in place, you'll end up with a relatively large and complicated AD. It's just the nature of this type of data - there's a lot of it, and it tracks a lot of relationships and dependencies, so it's complex. Nature of the beast.

Your first goal is to decide how you want to organize/design your AD structure and hierarchies, which is a project in and of itself.

Once you've got that settled, you should move on to reporting in your current environment, which is also not a trivial task. There are any number of tools for that, including plain old scripts to query and fetch data over LDAP, as well as third party tools. Quest's Windows and Active Directory Reporting Tools would probably be your "industry standard" you ask about, but they're expensive, and not a silver bullet by any stretch. For example, an AD redesign I did for a ~1,000 employee company, the file permissions report on their file servers generated Excel spreadsheets with over a quarter million lines.

Then, once you've figured out where you want to be, and where you are now, you need to plan out a way to get there. And, of course, this has to be done while the environment's running, because you can't very well take AD offline for a couple months while you sort things out. It's worth noting that this often results in the realization that it's easier and better to stand up a whole new domain or forest that you "migrate" the existing environment to.

Finally, once you've done all that, it's imperative to get polices and procedures in place and enforced to protect the structure and organization of the new and/or cleaned-up AD, otherwise you'll be back in the same mess you started with, in no time flat.

A lot of work.

Depending on the size and degree of disorganization of your AD environment, you may be better off just documenting your AD environment, tackling the low-hanging-fruit and implementing policies as you clean up a particular area. For example, cleaning up group memberships by removing ex-employees and blank groups, and implementing a procedure around employee separations, such as "run the following script to determine group memberships and remove the former employee from all groups."

but anyway you come at it, there's no tool to do it for you, and it's going to require a fair bit of effort to accomplish.

|improve this answer|||||
  • As I mentioned above: I'm seriously considering the "build a new structure" approach too. – Tonny Mar 15 '13 at 16:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.