privileged accounts report

[Venkatesh_16]

Hi there,

Is there is a command-line or script available which can generate a report of all accounts with administrator equivalent privileges in Windows AD setup, with added information on which machine the id resides., etc?

Thanks,
Venkatesh

[WFHC-WI]

Hi Venkatesh,

One thing you may wish to consider is visiting the Security tab on the Properties page for the domain. This can tell you specific permissions that have been applied to domain groups.

I don't believe you can assign permissions to any local computer account for domain configuration rights (although for security reasons I have never attempted this...)

You might also look at ACL software for permission scripting and auditing.

[Venkatesh_16]

We have a AD domain setup, wherein we restrict administrative access to member servers by adding users to a security group and that security group is inturn added to "Local Admins" groups of the member server. That way, users are not added directly to the Local Admins groups of the member servers. However, we need to counter check this as there have been instance where users accounts are added directly to the Local Admins group. Since we have a setup with more than 5000 Windows server, wondering if there are any scripts which automates this process. Thanks!

V