topic privileged accounts report in Windows Server 2003

privileged accounts report

Venkatesh_16 — Wed, 08 Apr 2009 03:49:03 GMT

Hi there,

Is there is a command-line or script available which can generate a report of all accounts with administrator equivalent privileges in Windows AD setup, with added information on which machine the id resides., etc?

Thanks,
Venkatesh

Re: privileged accounts report

WFHC-WI — Wed, 08 Apr 2009 19:48:40 GMT

Hi Venkatesh,

One thing you may wish to consider is visiting the Security tab on the Properties page for the domain. This can tell you specific permissions that have been applied to domain groups.

I don't believe you can assign permissions to any local computer account for domain configuration rights (although for security reasons I have never attempted this...)

You might also look at ACL software for permission scripting and auditing.

Re: privileged accounts report

Venkatesh_16 — Wed, 15 Apr 2009 04:33:24 GMT

We have a AD domain setup, wherein we restrict administrative access to member servers by adding users to a security group and that security group is inturn added to "Local Admins" groups of the member server. That way, users are not added directly to the Local Admins groups of the member servers. However, we need to counter check this as there have been instance where users accounts are added directly to the Local Admins group. Since we have a setup with more than 5000 Windows server, wondering if there are any scripts which automates this process. Thanks!

V