Interrogating security policies in Active Directory

[motoko]

Hi

I was wondering if anybody has attemped this.

If you use AD you'll know what a pain it is to find details on all group policies in AD, and I was thinking that there may be a way to do it via Crystal.

Any advice would be appreciated.

Cheers,

Motoko

 

[pelajhia]

I am surprised no one has answered this yet. I was very curious to see the answer myself. I am looking into the same thing; I have not been able to research a lot, but I have found out that the ad data resides in a database, so presumably that is why crystal doesn't have any special means to accessing it. I am going to work with our sys admin to find out more. Please let me know if you find any great documentation, etc on this. Good luck!

 

[pelajhia]

I found this article, but have not worked out all the kinks to get it to actually work. It looks like I am connecting to AD and it shows up in the Database expert window, but does not offer any tables or other data when expanded. (Says no items found).
Anyone have any ideas on this?
I have tried this in both CR10 and 9.

http://support.businessobjects.com/library/kbase/articles/c2014592.asp

Thanks!

 

[motoko]

Thanks for the article, I won't get chance to have a look until next week. I'll let you know if I get anywhere.

Thanks,

Motoko

 

[pelajhia]

Did you ever have any progress on this? I messed around with it for a bit, however could not get the darn thing to work.

 

[pelajhia]

I never got the driver to work.
The sys admin found some sort of scripting language (ldp - lightweight directory protocol) to query active directory and we are probably going to schedule a script to run via ce, then run a report based on that.

 

[poujor]

HI folks

You might want to have a look on

http://support.businessobjects.com/library/kbase/articles/c2016008.asp

on how to access Active Directory. Details on Group Policy Object are not to be found in in the AD database though. The only settings about Group policies in AD are: gPLink and gPOptions. Those informations are basically references to GUID's of GPO's and special settings, such as filtering, no override and block inheritance. The actual settings in the policies are stored below the sysvol share on Domain Controllers.
The group policy settings are stored in adm and inf files located on domain controllers. One way of accessing these files is using UNC's similar to: <domaincontrollername>\sysvol\<domainname>\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\
Below these you will find *.inf and *.adm with the settings of the Group Policy with GUID {6AC1786C-016F-11D2-945F-00C04fB984F9}

Regards
Poul

If you don't know the Group Policy Management Console (GPMC), consider having a look on it. It might help you

http://www.microsoft.com/windowsserver2003/gpmc/gpmcintro.mspx.

The Actual download page for the GPMC is

http://www.microsoft.com/downloads/...24-8CBD-4B35-9272-DD3CBFC81887&displaylang=en

 

[pelajhia]

I will certainly check out the material, however I will say that our sys admin did produce a csv file with names, groups, and a status (eg: disabled).
Thank you!

 

[Empmark]

I tried out the Crystal - AD connection for a bit but found that outputting to csv is much easier and more flexible. The original question was regarding group policies and not just group information (which can be pulled from AD unlike gpo info.) and I agree with Poujor that gpmc is the way to go. It is great for keeping up with group policy settings.

 

[pelajhia]

Yes, I see there is a difference b/w what motoko originally asked and what I needed. For once the data I need isn't the absolute hardest thing to get
Just to say I tried, I walked through the procedure in the document above trying a few different times, however I still remain unable to make a connection. Since the last bit of that document suggests that the csv method is not too terrible, I will stick with that for the time being.