Solved

Security Groups - How to find out the unused ones

Posted on 2007-04-02
7
409 Views
Last Modified: 2013-12-04
We have a windows 2003 active directory environment. we are doing a group audition because we are migrating the AD into a new domain. My question is this : if I want to check what Security groups are actually used and which ones are not. I know it's not a straightforward thing to do. But if someone can give me some directions that willl be great. The Security groups are used to permission for :
.NTFS/SHARE
.SQL
.GPOs
.Citrix applications
.Grant local administrative rights on servers/laptops and desktops.
.Miscellineous 3rd party apps

Now how do I find out which group is actually in use and which is not. We have around 3000 groups in domain. lol
0
Comment
Question by:gtrivedi
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
7 Comments
 
LVL 70

Expert Comment

by:KCTS
ID: 18835114
Double click on the security group in Active Directory Users and Computers. Go the the Members Tab.
If there are no members the group is not in use.
0
 
LVL 3

Expert Comment

by:hbbw063
ID: 18835187
What do you exactely mean by "not in use" ?
0
 

Author Comment

by:gtrivedi
ID: 18835402
[quote]
What do you exactely mean by "not in use" ?
[/quote]

some groups are there AD but they may not be used anywhere. Is there any property in AD which tells me when that group was added for permissioning on Share/SQL/Local Admin etc ?
That way I will not have to migrate such groups and the new domain will be a lot tidier.
0
Free Webinar: AWS Backup & DR

Join our upcoming webinar with experts from AWS, CloudBerry Lab, and the Town of Edgartown IT to discuss best practices for simplifying online backup management and cutting costs.

 
LVL 1

Expert Comment

by:proservis
ID: 18835983
Go to
start->administrative tools-> group policy management

There is Group Policy Modeling and Group Policy Results
setup new model or result and look at applied/denied GPOs
0
 
LVL 30

Accepted Solution

by:
LauraEHunterMVP earned 250 total points
ID: 18837007
Unfortunately this is a tough nut to crack, because you would need to query all of your member servers, application servers, workstations, etc., to determine if a particular security group is listed in any ACLs.

The quick-and-dirty way that most of us use?  Convert it to a distribution group, then wait a few days and see if anyone complains.

A reporting tool like SomarSoft's DumpSec might also help you determine which groups are not in use: http://www.somarsoft.com/

Hope this helps.

Laura E. Hunter - Microsoft MVP: Windows Server - Networking
0
 
LVL 71

Expert Comment

by:Chris Dent
ID: 19707859

No comment has been added to this question in more than 21 days, so it is now classified as abandoned.

I will leave the following recommendation for this question in the Cleanup Zone:
ACCEPT: LauraEHunterMVP {18837007}

Any objections should be posted here in the next 4 days. After that time, the question will be closed.

Chris-Dent
Experts Exchange Cleanup Volunteer
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article runs through the process of deploying a single EXE application selectively to a group of user.
A company’s centralized system that manages user data, security, and distributed resources is often a focus of criminal attention. Active Directory (AD) is no exception. In truth, it’s even more likely to be targeted due to the number of companies …
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …

730 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question