Solved

Security Groups - How to find out the unused ones

Posted on 2007-04-02
7
410 Views
Last Modified: 2013-12-04
We have a windows 2003 active directory environment. we are doing a group audition because we are migrating the AD into a new domain. My question is this : if I want to check what Security groups are actually used and which ones are not. I know it's not a straightforward thing to do. But if someone can give me some directions that willl be great. The Security groups are used to permission for :
.NTFS/SHARE
.SQL
.GPOs
.Citrix applications
.Grant local administrative rights on servers/laptops and desktops.
.Miscellineous 3rd party apps

Now how do I find out which group is actually in use and which is not. We have around 3000 groups in domain. lol
0
Comment
Question by:gtrivedi
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
7 Comments
 
LVL 70

Expert Comment

by:KCTS
ID: 18835114
Double click on the security group in Active Directory Users and Computers. Go the the Members Tab.
If there are no members the group is not in use.
0
 
LVL 3

Expert Comment

by:hbbw063
ID: 18835187
What do you exactely mean by "not in use" ?
0
 

Author Comment

by:gtrivedi
ID: 18835402
[quote]
What do you exactely mean by "not in use" ?
[/quote]

some groups are there AD but they may not be used anywhere. Is there any property in AD which tells me when that group was added for permissioning on Share/SQL/Local Admin etc ?
That way I will not have to migrate such groups and the new domain will be a lot tidier.
0
Edgartown IT Case Study

Learn about Edgartown's quest to ensure the safety and security of the entire town's employee and citizen data. Read the case study!

 
LVL 1

Expert Comment

by:proservis
ID: 18835983
Go to
start->administrative tools-> group policy management

There is Group Policy Modeling and Group Policy Results
setup new model or result and look at applied/denied GPOs
0
 
LVL 30

Accepted Solution

by:
LauraEHunterMVP earned 250 total points
ID: 18837007
Unfortunately this is a tough nut to crack, because you would need to query all of your member servers, application servers, workstations, etc., to determine if a particular security group is listed in any ACLs.

The quick-and-dirty way that most of us use?  Convert it to a distribution group, then wait a few days and see if anyone complains.

A reporting tool like SomarSoft's DumpSec might also help you determine which groups are not in use: http://www.somarsoft.com/

Hope this helps.

Laura E. Hunter - Microsoft MVP: Windows Server - Networking
0
 
LVL 71

Expert Comment

by:Chris Dent
ID: 19707859

No comment has been added to this question in more than 21 days, so it is now classified as abandoned.

I will leave the following recommendation for this question in the Cleanup Zone:
ACCEPT: LauraEHunterMVP {18837007}

Any objections should be posted here in the next 4 days. After that time, the question will be closed.

Chris-Dent
Experts Exchange Cleanup Volunteer
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Always backup Domain, SYSVOL etc.using processes according to Microsoft Best Practices. This is meant as a disaster recovery process for small environments that did not implement backup processes and did not run a secondary domain controller that ne…
Uncontrolled local administrators groups within any organization pose a huge security risk. Because these groups are locally managed it becomes difficult to audit and maintain them.
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.

734 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question