domain accounts / groups

[prinand]

is there a possebility to make a listing on a PDC which lists all the groups and the members in every group ?

The previous administrator created a lot of groups so it is quite a hassle tro add /remove people from groups if eg. some one gets replaced and the new guy needs the same acces as his predecessor. [sig][/sig]

 

[ggholl]

To my knowledge there is no way you can display all. I am used to running domains which were already set (permissions, groups, etc.) a best practice I have found is. You can take the original person (the one who has quit) and copy their account to their replacement prior to disabling/deleting it. That way you don't have to search on their access to the domain. Just rename the account as opposed to deleting it until the new guys starts, that way you don't have to reapply anything for the new person. Once you create the new account you can delete the old employees...
[sig][/sig]

 

[wallerkr]

Check out SHOWGRPS in the NT Server resource kit. It will give it to you by user. You should be able to pipe a list of user logins to it and redirect the output to a file, or do it as needed by user.

Sample output from 'showgrps ELECTRIC\ataylor':

User: [ELECTRIC\ataylor], is a member of:

ELECTRIC\Domain Users
\Everyone
ELECTRIC\SCADA

[sig][/sig]

 

[jimbo4u]

Try using one of these utilities, Hyena or Dameware, they both offer a soution to your problem. [sig][/sig]

 

[wallerkr]

DOH! I just started using Hyena and forgot all about it. You are correct, it has all you need to get that info. [sig][/sig]

 

[AllenKass]

I was reading a magazine article the other day that addressed showing the groups and who was a member. The utility mentioned was DumpSec (formally DumpACL) utility. It is located at

http://www.somarsoft.com

Hope this helps
[sig][/sig]

 

[kjonnnnn]

If a new person joins your organization... simple rename the previous account with the new person's name. You then remove any groups that that person doesnt need to belong to. [sig][/sig]