Display groups per server?

[Tds133]

Looking at a domain that over the years, has gone out of
control as far as fileshare groups. This domain has 600
users and more than 8000 local and domain groups! This
company doesnt seem to think any 2 users should have same
access to anything

Is there any application that helps to map out each
server -> fileshare -> directory with the groups
associated with each? Im thinking of a tree diagram, I
guess which lets you see the whole picture of the domain?

Id be also interested in hearing from anyone else who has
been in this situation whereby they have had to make a
serious cleanup (read - reduction of groups) like this
before?
Kind regards,
Todd Sales

 

[mcconmw]

DumpSec from

http://www.systemtools.com

is a freeware utility that should take care of you. It will dump the permissions on every directory plus provide several other useful functions. It is a must have for any admin.

I have never done anything to the scale that you are referring to, but I have done a lot of security revamps on servers and the first and most important thing is to get the upper management into your corner. When things have digressed to the point you are facing people will resist changing. Particularly middle management types will feel that you are taking control away from them and they will resist it. Develop a simplified model (by dept, etc)and then present it to the powers that be. Pick out your most foolish examples of security overkill to offer as examples. Present it as a cost savings by reducing administrative overhead and force any middle management resistance to require their review and approval for changes. At the end of the day all upper management is going to listen to is financial impact. You'll save yourself a lot of grief in the long run by taking a very structured approach. Good luck.