In well managed Active Directory every group has its purpose. As the number of groups grows and Active Directory spreads out globally it becomes challenging to manage all groups from one central authority. This is where you start thinking about delegation of group management. In the…
Putting exactly the same members into different groups is not the only way to create duplicate groups. Because Active Directory allows nested groups, two seemingly different groups might end up having same “effective” user members. Consider this simple example: GroupA …
One way of getting rid of excessive groups is to find which groups have similar membership. The simplest case is when the list of direct members of a group matches another group’s list. Groups with same direct members are not…
This time we will see how we can uncover another type of toxic and potentially unnecessary Active Directory objects – circular nested groups. First let’s define what circular nested groups are. These are groups that include themselves by a virtue of…
In this post we’ll explore how to discover empty groups in Active Directory. Empty groups are groups that have no members. Obviously, if this condition does not change for a while you might want to consider deleting those groups. First,…
It is a simple fact that as the time goes by Active Directory gets messy. Lack of automated provisioning and deprovisioning practices, employee turnover, Active Directory restructuring due to ongoing M&A activity are just a few reasons why. A good…
