RE: [ActiveDir] Checking if security principal is used in an ACL on the FS

[Grillenmeier, Guido]

Title: Checking if security principal is used in an ACL on the FS

hey Jorge - when you prepare for nr (2), don't forget the groups that are nested into other groups - they could be nested into other AD groups or into local server groups on the target resource.  This won't make your analysis any easier, I know.

 

And who says you can't do this by name?  You'll find a few tools that report on ACLs by listing the names of the respective security principals (I know that Quest's Reporing tool does this - but I'm sure there are others as well) => might be a more reasonable approach, esp. if you want to check the results against the existing ACLs on the FS

 

Also, before you delete any security group, I'd suggest to "disable" the group simply by changing it's scope from security to distribution => this way the group is no longer added to anyone's security token at logon and you'll quickly hear from the users if they're missing some access...

 

/Guido

---

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jorge de Almeida Pinto
Sent: Montag, 2. Mai 2005 17:06
To: ActiveDir@mail.activedir.org
Subject: [ActiveDir] Checking if security principal is used in an ACL on the FS

Hi,

After a migration we did we want to cleanup some security principals (mostly groups)

Situation:
* File server with data that uses AD groups for the ACLs
* AD OU structure with groups where most of them are used on the file system to protect in some manner. (the groups are not used for anything else!)

What I want to do:
* Cleanup ALL unused groups

Possible unused groups that can be removed:
(1) groups with no members but used on the file system
(2) groups with members but not used anywhere on the file system

Solution for (1)
* Query AD for al empty groups from the OU structure and delete them
* Force AD replication
* Use SUBINACL to remove deleted SIDs with the option /CLEANDELETEDSIDSFROM

Solution for (2)
* Get all used SIDs used on the file system
* Get all GROUP SIDs from AD
* "Extract the file system SIDs from the GROUP sids in AD and remove the groups that are left

Anyone got any other ideas or a tool that can do this for (2)

PS.: It would be nice if the file system was integrated with AD like in the NDS

Cheers,
#JORGE#

This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.