Global group names

oliverw

Hi Peeps,

I've just been tasked with putting together proper descriptions on the global groups, group names. I would like to put \\server\folder etc in their descriptions but finding it hard to find out where the group names are pointing to.

I'm going on a 70-290 next week so will hopefully learn how then but if anyone has any tips or tools for this i'd be grateful as we have loads of these.

dynamik

I'm not sure if I understand your question. Are you looking for a way to find all the resources a group has been assigned access to?

Also, is there a reason you need to put what shares the groups have access to in their description? From a security perspective, you may not want to advertise what resources a group has access to.

oliverw

Sorry i didnt word that very well. What i was meaning is for example if we had a a group called GG - Sales. That would give who ever was in the group access to the sales folder on \\server1\salesfolder. I.e the path. I would like to put this in the description or notes part in the properties of that group in ad. This would help whomever is setting the user accounts up manually map the drives or select the correct batch file to be in.

Because we have a fair amount of these groups to save me having to hunt around all our servers and folders and do it manually im looking for a way to maybe audit these or better still if theres a run command which shows where the group is pointing to.

As for the security implications i'll take that onboard and have a think and maybe just document the paths rather then add it to the active directory properties.


Hope that explains it abit better and thanks for your help.

mwgood

I am not aware of any location to access what resources a group has access to - except for the permission on the resources themselves. Groups don't "point" to resources - resources "point" to groups.

You will probably need to go through the major shared folders you are referring to and audit the permissions in order to understand which groups have access to what.

oliverw

Ok thanks for your help anyway. I was kind of expecting to have to look at each share but its going to take me a whole lot of time

theseman

I am not sure what you are looking for exactly - but if you are looking to audit what users/groups have access to what shares then Dumpsec should work for you.

http://www.somarsoft.com/

-Travis

oliverw

thats exactly what i was after, had just installed it. Looks like it still maybe easy to just logon to each server though. Would have liked a pukka server2003 command prompt thing so i could just type for instance start - run - cmd - lookup gg - slaes and it would say oh that would group lets you get into \\server\sales. But i suppose it will be good practice to login to all the servers and look at the shares. Plus i cant see any of our guys letting me install third party software.