juragan
asked on
How do I export active directory delegation permissions & rights?
Hi, I'd like to export the existing security permissions or delegations within my Active Directory, i.e. who/which "administrator group" has what rights on each OU. Basically I need to review all the delegations and do changes to make it more secure.
Does anyone know of a script or tool that can easily do this kind of task?
Does anyone know of a script or tool that can easily do this kind of task?
This question has been asked before - I do not know of any tool that is bale to do this.
The recommendation is always to create groups and delegate to the group, that way delegtions are much easier to manage and control
The recommendation is always to create groups and delegate to the group, that way delegtions are much easier to manage and control
bale = able !
ie
This question has been asked before - I do not know of any tool that is able to do this.
The recommendation is always to create groups and delegate to the group, that way delegtions are much easier to manage and control
ie
This question has been asked before - I do not know of any tool that is able to do this.
The recommendation is always to create groups and delegate to the group, that way delegtions are much easier to manage and control
ASKER
hi faiga16,
I have just noticed that my question was also posted in SQL 2005 zone by accident :)
I read the article, and it seems too complicated for me as I have only a little knowledge on SQL. The query example is only exporting AD attributes of a user object. Perhaps you can help to construct a query to export the permissions?
What I need is to audit the permissions or delegation on each and every OUs. For example, on an OU called "MyOU" I need to find out who has the rights to change the user password, who has the rights to move user's mailbox, who has the rights to write into a specific AD attributes, and so on.
I have just noticed that my question was also posted in SQL 2005 zone by accident :)
I read the article, and it seems too complicated for me as I have only a little knowledge on SQL. The query example is only exporting AD attributes of a user object. Perhaps you can help to construct a query to export the permissions?
What I need is to audit the permissions or delegation on each and every OUs. For example, on an OU called "MyOU" I need to find out who has the rights to change the user password, who has the rights to move user's mailbox, who has the rights to write into a specific AD attributes, and so on.
ASKER
hi KCTS, I agree with you. The thing is that I have just inherited this new domain, so I need to review/audit the existing permissions delegation and do the necessary changes.
I don't think its possible - I would love to pe proved wrong :-)
You can of course examine the ACLs on the Active Directory - but its going to be tedious
ASKER
So I have to manually check the permissions on each and every OU? :-(
If anyone has a another way I would very much like to know myself ;-)
Me too.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
I'm in the same boat - need to audit all the permissions on directories and files. Hope a good answer comes up. I'll be looking at that script closer.
from there you can query it.