Solved

Security Groups - How to find out the unused ones

Posted on 2007-04-02
7
400 Views
Last Modified: 2013-12-04
We have a windows 2003 active directory environment. we are doing a group audition because we are migrating the AD into a new domain. My question is this : if I want to check what Security groups are actually used and which ones are not. I know it's not a straightforward thing to do. But if someone can give me some directions that willl be great. The Security groups are used to permission for :
.NTFS/SHARE
.SQL
.GPOs
.Citrix applications
.Grant local administrative rights on servers/laptops and desktops.
.Miscellineous 3rd party apps

Now how do I find out which group is actually in use and which is not. We have around 3000 groups in domain. lol
0
Comment
Question by:gtrivedi
7 Comments
 
LVL 70

Expert Comment

by:KCTS
ID: 18835114
Double click on the security group in Active Directory Users and Computers. Go the the Members Tab.
If there are no members the group is not in use.
0
 
LVL 3

Expert Comment

by:hbbw063
ID: 18835187
What do you exactely mean by "not in use" ?
0
 

Author Comment

by:gtrivedi
ID: 18835402
[quote]
What do you exactely mean by "not in use" ?
[/quote]

some groups are there AD but they may not be used anywhere. Is there any property in AD which tells me when that group was added for permissioning on Share/SQL/Local Admin etc ?
That way I will not have to migrate such groups and the new domain will be a lot tidier.
0
Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

 
LVL 1

Expert Comment

by:proservis
ID: 18835983
Go to
start->administrative tools-> group policy management

There is Group Policy Modeling and Group Policy Results
setup new model or result and look at applied/denied GPOs
0
 
LVL 30

Accepted Solution

by:
LauraEHunterMVP earned 250 total points
ID: 18837007
Unfortunately this is a tough nut to crack, because you would need to query all of your member servers, application servers, workstations, etc., to determine if a particular security group is listed in any ACLs.

The quick-and-dirty way that most of us use?  Convert it to a distribution group, then wait a few days and see if anyone complains.

A reporting tool like SomarSoft's DumpSec might also help you determine which groups are not in use: http://www.somarsoft.com/

Hope this helps.

Laura E. Hunter - Microsoft MVP: Windows Server - Networking
0
 
LVL 70

Expert Comment

by:Chris Dent
ID: 19707859

No comment has been added to this question in more than 21 days, so it is now classified as abandoned.

I will leave the following recommendation for this question in the Cleanup Zone:
ACCEPT: LauraEHunterMVP {18837007}

Any objections should be posted here in the next 4 days. After that time, the question will be closed.

Chris-Dent
Experts Exchange Cleanup Volunteer
0

Featured Post

6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

Join & Write a Comment

No security measures warrant 100% as a "silver bullet". The truth is we also cannot assume anything but a defensive and vigilance posture. Adopt no trust by default and reveal in assumption. Only assume anonymity or invisibility in the reverse. Safe…
Article by: btan
The intent is not to repeat what many has know about Ransomware but more to join its dots of what is it, who are the victims, why it exists, when and how we respond on infection. Lastly, sum up in a glance to share such information with more to help…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now