I want to find a way to visualise security groups and their members

Question

I hope someone can help...

I want to find a way to visualise security groups and their members, and be able to show that to users in a simple format for discussion. I have a simple matrix in Excel that does the trick - showing users against groups and groups against folders. What I'd like is a simple way to get the data out of AD or Windows Explorer as text.

So far I have gone to Windows Explorer, right-click file/folder > properties > security > Edit (Permissions); then screenshot the pages of groups that are applied to that folder.

• I then type these groups into Excel.
• I do similar to get members of groups.

What I'd like if anyone knows is a way to extract the info as text: members of groups and groups applied to folders or files - either from AD or Windows Explorer or wherever. I'm not an expert by any means, so you may have to dumb it down a little.

---

The next thing will be to get a tool that shows me for a group, what files and folders it is applied to. To be able to SEE all this info would be amazing - we currently rely heavily on the knowledge of certain staff, as we just can't extract the info to be able to visualize it.

We really should rationalize our groups too.

Similar post I've found:

• How to get an text list of login names for a user group of a windows server

Answer 1

What I'd like if anyone knows is a way to extract the info as text: members of groups

dsquery -name GroupName | dsget group -members [-expand]

That will look up a groupname (you can use wildcards if you'd like), and then pipes it to extract a list of the members - which themselves may include groups, so you can optionally expand all the way down to just usernames.

The next thing will be to get a tool that shows me for a group, what files and folders it is applied to.

There's nothing that will get this for you, going in that direction. The thing that stores groups (AD) does not know what they have permissions to. The permissions are held in metadata of the item itself. That item may be another object in AD, or a file on your fileserver, or a piece of the Registry on a server, or a SharePoint object, or a SQL entity ... You have to query the object, to see what groups or users have permissions on it.

So, to get the ACLs on a given NTFS folder or file, you can use xcacls.vbs or similar. But walking a large directory can be tedious to review, so keep that in mind as you attempt this exercise.