Hello All,
I'm in search for tool that can capture and report the number of direct, and nested, members of a systems admin group across any/all Windows Server 2k3/8 servers in a 3000 system environment. All servers are members of the same domain under Active Directory. I would like to stay clear of agent based solutions. My first requirement for the tool is to gather a server count of all systems that have an alarming amount of admin group members (have yet to set a specific threshold). From that, I will take the necessary steps to minimize this count. The second requirement for the tool would be to monitor and alert any changes of the admins group for all systems in the environment. Is there a tool that can perform both, or either?
You input is appreciated. Thank you
Espazito [/align]
0 Comments   [ - ] Hide Comments


Please log in to comment

Rating comments in this legacy AppDeploy message board thread won't reorder them,
so that the conversation will remain readable.
Answer this question or Comment on this question for clarity


I can write a Vbscript that can do all of these things but one step at a time. Let me know if you are interested in that. Here is the step by step action script I thought of.

First Requirement:
Get all machines in the domain including worskations and servers
For each machine see what are all the groups those have admin access
Enumeraate each group member for admin groups recursively

Second Requirement:
Create a Vbscript that dumps all admin groups to a text file, this will a reference file.
Create another script or have the logic in the same script to run on daily basis and compare with the reference file.
When you approve the chnges you have to create a new reference file.

Let me know what you think.
Answered 04/02/2011 by: lurims
Senior Yellow Belt

Please log in to comment
Nested group memberships are tricky, as the usual AD method (memberOf) doesn't return such memberships.Search for 'GetInfoEx("tokenGroups")' to turn up Mr Mueller's (sp?) excellent selection of scripts.
Answered 04/04/2011 by: VBScab
Red Belt

Please log in to comment
Already explored the VBScript route. I need something that doesn't require much skill to manage and configure for the level 1 guys, per mgmt.
I'm thinking of something like DataAdvantage from Varonis, or Hyena from System Tools. Anyone familiar with either, or have any input on a similar tool.
Answered 04/06/2011 by: espazito
Yellow Belt

Please log in to comment
If there is anyone with an answer to this I am also really interested in the answer. This is something I have been trying to do with scripts but not succeeded with, so any tool that works fine would be of great benefit.
Answered 10/23/2011 by: anderskarl
Yellow Belt

Please log in to comment