RE: [ActiveDir] AD Security Group Information
One small correction and one small alternative ;o) Use objectcategory=group versus objectclass=group unless you have indexed objectclass. You will notice a substantial query speed delta. I don't see mention of a specific type of security group and the query provided only gets Security enabled global groups. If you want all security enabled groups change grouptype=-2147483646 to grouptype<=-1 -- O'Reilly Active Directory Third Edition - http://www.joeware.net/win/ad3e.htm From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Thommes, Michael M.Sent: Tuesday, October 31, 2006 7:17 AMTo: ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] AD Security Group Information adfind -default -f "&(objectclass=group)(groupType=-2147483646)" -tdc whenChanged hth, Mike Thommes From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Frank AbagnaleSent: Tuesday, October 31, 2006 2:51 AMTo: activedir@mail.activedir.orgSubject: [ActiveDir] AD Security Group Information I'm having a clear up of my domain and there are approx 8000 security groups. Some of these are no longer required, how is the best way to determine whether the groups are still in use? Is there any way to query the groups to identify when they were last modified? thanks Frank Single Domain, Windows 2003 FFL We have the perfect Group for you. Check out the handy changes to Yahoo! Groups.
RE: [ActiveDir] AD Security Group Information
adfind -default -f "&(objectclass=group)(groupType=-2147483646)" -tdc whenChanged hth, Mike Thommes From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Frank Abagnale Sent: Tuesday, October 31, 2006 2:51 AM To: activedir@mail.activedir.org Subject: [ActiveDir] AD Security Group Information I'm having a clear up of my domain and there are approx 8000 security groups. Some of these are no longer required, how is the best way to determine whether the groups are still in use? Is there any way to query the groups to identify when they were last modified? thanks Frank Single Domain, Windows 2003 FFL We have the perfect Group for you. Check out the handy changes to Yahoo! Groups.
RE: [ActiveDir] AD Security Group Information
in my opinion, the best way to determine if security groups are still in use or not, is to convert those security groups to distribution groups. if nobody shouts for some time (TBD of course) you could remove/delete the groups jorge From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Frank AbagnaleSent: Tuesday, October 31, 2006 09:51To: activedir@mail.activedir.orgSubject: [ActiveDir] AD Security Group Information I'm having a clear up of my domain and there are approx 8000 security groups. Some of these are no longer required, how is the best way to determine whether the groups are still in use? Is there any way to query the groups to identify when they were last modified? thanks Frank Single Domain, Windows 2003 FFL We have the perfect Group for you. Check out the handy changes to Yahoo! Groups. This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.
RE: [ActiveDir] AD Security Group Information
Would the mod date help you determine if a group is still
'used'? I suspect not.
If by 'use' you mean the group has members and is
permissioned against a resource somewhere then you'll need to check every ACL
and ACE on every resource and look for an entry matching your group
name(s).
If you find no match, then I'd suggest you first remove
members and rename the group, then if no issues arise, remove the
group.
my 2 penneth,
neil
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Frank
AbagnaleSent: 31 October 2006 08:51To:
activedir@mail.activedir.orgSubject: [ActiveDir] AD Security Group
Information
I'm having a clear up of my domain and there are approx 8000 security
groups.
Some of these are no longer required, how is the best way to determine
whether the groups are still in use? Is there any way to query the groups to
identify when they were last modified?
thanks
Frank
Single Domain, Windows 2003 FFL
We have the perfect Group for you. Check out the handy
changes to Yahoo! Groups. PLEASE READ: The information contained in this email is confidential and
intended for the named recipient(s) only. If you are not an intended
recipient of this email please notify the sender immediately and delete your
copy from your system. You must not copy, distribute or take any further
action in reliance on it. Email is not a secure method of communication and
Nomura International plc ('NIplc') will not, to the extent permitted by law,
accept responsibility or liability for (a) the accuracy or completeness of,
or (b) the presence of any virus, worm or similar malicious or disabling
code in, this message or any attachment(s) to it. If verification of this
email is sought then please request a hard copy. Unless otherwise stated
this email: (1) is not, and should not be treated or relied upon as,
investment research; (2) contains views or opinions that are solely those of
the author and do not necessarily represent those of NIplc; (3) is intended
for informational purposes only and is not a recommendation, solicitation or
offer to buy or sell securities or related financial instruments. NIplc
does not provide investment services to private customers. Authorised and
regulated by the Financial Services Authority. Registered in England
no. 1550505 VAT No. 447 2492 35. Registered Office: 1 St Martin's-le-Grand,
London, EC1A 4NP. A member of the Nomura group of companies.
