report of which accounts and groups have been given ResetPassword rights to all OUs

[Guest]

Trying to create a report of what rights a global group has within AD.

Thanks.

[kstanush]

Re: report of which accounts and groups have been given ResetPassword rights to all OUs

Try selecting the containers/OUs in Hyena's right window (multi select them if you have more than one), select Account Functions->List Directory Security.

If the containers/OUs are in different parts of your directory, let me know and I'll show you how to list all of them at once.

Once the security is displayed, sort on the access column for the user/group that you are interested in.

Let me know how this works out.

[Guest]

Re: report of which accounts and groups have been given ResetPassword rights to all OUs

This worked, thanks. However, I would also like to report on the specific permissions applied to each object. For example: When selecting the OU and displaying the security tab, I select the desired group and its respective permissions are displayed. If I select the Advanced tab and choose Edit, I am presented with the Permission Entry for XX dialog box, where the specific permissions for the object are displayed. Some examples; Full Control, Read Permissions, Create All Child Objects, Reset Password, etc.

Can Exporter retrieve this info?

Thanks. This app is an incredible timesaver!

[kstanush]

Re: report of which accounts and groups have been given ResetPassword rights to all OUs

No, unfortunately we don't have this information. I will contact Microsoft on Monday to see where/how this information is stored and add it to Exporter (maybe Hyena too).

I don't know of another way to get it, but one would think that Microsoft has some command line tool to get it.

I'll ask them too when I call them what can be used.

[kstanush]

Re: report of which accounts and groups have been given ResetPassword rights to all OUs

This problem was reported to Microsoft and is still under investigation.

[Guest]

Re: report of which accounts and groups have been given ResetPassword rights to all OUs

Thanks for the update.

[kstanush]

Re: report of which accounts and groups have been given ResetPassword rights to all OUs

This information is going to be a little hard to get. I got the details on where/how to get it, but need to perform some testing to see if the results will give what is needed. Due to the possible massive amount of data that would be produced by this, we may look at implementing this in Exporter Pro first, as we are getting asked more and more about having the export function retrieve AD permissions.

But regardless of where its implemented, its going to take some time to get the information.

I'll try to do some testing this week and next to see if the information that I got from Microsoft produces the results that I want.

I'll keep you posted.