Windows Forum

Ask something
Discussion Locked

Distribution Groups

0 helpful
6 replies

by blitzsonik

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have just taken over responsibility of my organization's Active Directory. It was a collaborative effort amongst 5 indivdual Domain Admins. As you may have guessed, it is a complete mess.

I am looking for tools to help clean it up. Things that will tell me if a Distributin Group is still being used and which computer and/or user accounts are still active.

Also, how long should I hang on to old inactive accounts. Currently we do not delete accounts - just disable - and I am abit weary about that. Should I be concerned?

I have found some change management software to help control changes made but i am not sure which ones are any good. Any thought?

Thanks in advance!

Blitz

6 replies

by joseph moore

Me, I use Dameware NT Utilities. It has full AD support.
http://www.dameware.com
I've been using it for years; don't know how I would live without it. It can tell you who's in a group, user account age, etc. All kinds of stuff. It can export to text files your AD info, which you can then pull into a spreadsheet, and sort away.

by joseph moore

Oh, the part about disabling accounts vs. deleting them. Here's my policy.
When someone leaves the company, I disable their account, along with a few changes. I remove the user account from all groups EXCEPT the "Domain Guests" group. This group I add to their account and make it the default group for them.
I also turn the day/times they can log in (the HOURS setting) to all being off.
Next, make sure they are Denied access to inbound VPN/RRAS connections.
I remove their home directory definition, and remove any logon script entry.
I also set the workstations they can log into to only display a single machine name that doesn't exist on the network ("FAKEMACHINE").
Last, I change the Description to be something like "DELETE ACCOUNT END OF JUNE 2005", which is just a note to myself to delete the account after a while.
I leave disabled accounts in this state for a couple of months, because you never know. But after a couple of months, it's always been a safe amount of time to pass for deleting an account.

by bkinsey1

If you're looking for pre-pakaged apps and tools, there are a ton of them, but I can't give many recommendations. If you're more of a do-it-yourselfer, and want to get into scripting, you can do just about anything you want through WSH, ADSI, and WMI.

As a specific example to address one of your issues, here: http://pubs.logicalexpressions.com/Pub0009/LPMArticle.asp?ID=68 is a script to find old, unused computer accounts. A little research could modify it to do the same for user accounts.

I'd also recommend installing and looking over the Windows Support Tools and Windows Resource Kit Tools. Lots of stuff of varying usefulness, depending on your needs and requirements.

Overall, there are advantages to either way of doing things; the off the shelf software way is easier, but costs more. But whichever route (or combination of routes) you choose, you definitely need to manage your network. Good for you that you see the need starting off; bad for you it was left for you in such a mess. . . .

On the subject of old user accounts, our policy is to disable an account immediately on employee separation, but not to delete it (or their mailbox) for 30 days. In cases where there may be reasons to hold onto it longer (i.e. legal issues, grievances, anything that might bite you later), keep it disable, but keep it, until you're sure you don't need it. Most of the time, that's not an issue. . . .

This discussion is closed to new replies.