Subscribe to Windows IT Pro
December 28, 2009 12:00 AM

Document Your Domain Groups

The final report will please you, your security department, and your auditors
Windows IT Pro
InstantDoc ID #103358
Rating: (10)
Downloads
103358.zip

The piece to this process that helps keep things sorted properly involves writing the current overall nested group hierarchy level of each group member to the 256th column (which has column heading IV). To help understand this, a picture is truly worth a thousand words. So let's take a look at Figure 1 and Figure 2. Here you'll see an example of a fairly complex nested group listing. In Figure 1 you'll see that the group being processed is named RTC Local User Administrators. It contains one user—Mark Hassall—and two nested groups—RTCDomainUserAdmins and VPNUsers (note the red font, indicating they are groups). These three members fall directly under RTC Local User Administrators in column A. You'll see that the RTCDomainUserAdmins group has only one member—Michael Holms—and that it is indented to indicate that it belongs to RTCDomainUserAdmins group. The VPNUsers group contains one user—Craig Playstead—and two nested groups—Domain Admins and RTCDomainUserAdmins—and they are indented one level to indicate that they belong to the VPNUsers group. The Domain Admins group members are indented as well to show they belong to the Domain Admins group. And finally, you'll see that the VPNUsers member RTCDomainUserAdmins is colored with a purple font and also has a notation indicating it is a recurring group and, therefore, you will not see indented members listed under it. You can, however, find the RTCDomainUserAdmins group in the listing and ascertain who the members of that group are.

Sorting It Out

To ensure that I all my group listings would be sorted properly, I needed a single column to sort on that was structured in a fashion that would guarantee everything fell into its proper place.

As you can see in Figure 2, by simply keeping track of the complete path of each group member's hierarchical structure and writing that to column 256 I could sort the worksheet on column IV and everything would fall right into place. The asterisks are used as a delimiter to mark the change in the hierarchy.

Wrapping It Up

The process of evaluating my groups continues until every group in the domain is evaluated. The process then exits the main loop and the script begins to wrap things up by providing group summary information and hyperlink listings to all groups with and without members. Accessing any particular group is simply a matter of clicking on the group name hyperlink. Note that if all your groups do contain members there will not be any references to "No Members."

I think that you'll find that having this documented within Excel has its advantages. Everything is contained within one file and all the groups are contained within their own individual worksheet. And if you need to know which groups a specific user belongs to you can easily use the "Find All" feature in Excel and locate every occurrence of that user. You could also use the "Find All" feature to locate everywhere a disable account appears or where you had recurring nested groups, which could ultimately help you find inconsistencies that might exist within some of your group structures.

This script is a very useful admin utility that will provide invaluable reports as well as a permanent record of your group structures for any given point in time. It will also save you a lot of time and serve you and your auditors well if you are asked to provide detailed group information during the hectic audit season.

Related Content:

ARTICLE TOOLS

Comments
  • Wallace
    2 years ago
    Oct 15, 2010

    Also , it would be great to link this to Visio and have some kind of visual diagram

  • Wallace
    2 years ago
    Oct 15, 2010

    Fantastic script. Is there anyway to only show DL nested groups and not security groups?

  • Anne
    2 years ago
    Mar 02, 2010

    The problems in the article have been fixed. Thanks for letting us know about them, and thanks for reading! -Anne Grubb, web & developer editor, Windows IT Pro and DevConnections

  • Don
    2 years ago
    Mar 02, 2010

    Cannot find Dowload the Code Here button!

  • RYAN
    2 years ago
    Feb 15, 2010

    First of all thanks for a great article. This type of thing is handy in dealing with compliance auditors.

    Second thanks for posting a script that's not PowerShell. I'm finding people are adapting PowerShell to things where it doesn't really fit just for the sake of being trendy.

    One piece of advice: Good AD administrators will have long, descriptive group names. I've had several issues with a similar .vbs bombing out over group names that exceeded the Excel's character limitations. If you're looking for a work-around to this there's one here: http://www.ryanboyer.net/group-membership/.

    You'll also find solutions for selectively auditing especially sensitive groups rather than every group across your (potentially) huge enterprise.

    Again - thanks for a terrific article. I keep subscribing to your magazine and interest groups because of useful articles like this one.

    -Tallarico
    Also - for

You must log on before posting a comment.

Are you a new visitor? Register Here

advertisement

advertisement

Windows is a trademark of the Microsoft group of companies. Windows IT Pro is used by Penton Media Inc. under license from owner.