Delegation - Effective Rights

We have delegated our OU's to different AD Security groups. Now the delegation has been so much that its difficult to know who has what rights and where, hence i would like to if there is a way to know what permissions does each group have on different OU in the domain.

Regards

You could script this, but I'm not a scripter, so I can't help in this area
other than pointing you to Microsoft's Script Center. Otherwise, there are
third party software that give you a complete report, at a cost, of course.
See if the following helps.

ARKAD - Admin Report Kit for Active Directory

you can use DSACLS utility - more info at
http://support.microsoft.com/kb/281146

Hello Phani,

Depending on how many OUs you have you can either script it or you can
enable advanved features in ADUC, then select properties on the OU, security
tab, advanced tab etc

Hi Phani,

The good news is that this is a very typical scenario faced by virtually any
organization doing delegations in Active Directory.

The bad news is that this isn't that easy to figure out - what you need to
do is in effect accurately determine the effective resultant access in your
Active Directory.

And while some have suggested the use of dsacls or scripting, neither dsacls
nor scripting in itself can answer the question for you, because these tools
merely show you permissions, WHICH IS NOT THE SAME AS effective delegated
access.

Most IT admins enounter this subtle but important pitfall

In order to accurately assess delegated access in AD, you can follow the
steps in left column of this page

Or you could use an automated solution, such as Gold Finger

He has a free utility that
will do what u need. I can't remember the name of it off the top of my head
but it is on his site. While you are there check out the rest of his tools.
They work great!
--
MR


"Phani" wrote:

> We have delegated our OU's to different AD Security groups. Now the delegation has been so much that its difficult to know who has what rights and where, hence i would like to if there is a way to know what permissions does each group have on different OU in the domain.
>
> Regards