This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(0, 15%, 10%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMC%3C/text%3E%3C/svg%3E)
So I am a noob to this AD world and I am trying to get assistance with a problem. My team has been assigned a security group in AD some years ago. Our team is now splitting and we need to create a new security group so the team has the right access and then parse out all servers that the other team no longer needs access to. We have been given access via the security group to many servers across the enterprise and unfortunately, there was no record kept of the servers. I have been told the only way to find this information out would be to log in to every server in the enterprise and see if the id is present.
Can some tell me is there a way to put in a PowerShell command similar to what I listed below that can be used on an enterprise DC/Forest DC to pull back the listed items below?
Group id: (Security Group)
Server Location: (example) Servername/path
Domain Name:
The script when researching I found was
Get-ADGroupMember -Identity "enterprise admins" -Server "ad.2012.com" | Select-Object Name, distinguishedName
I truly appreciate any feedback to help.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(256, 74%, 34%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERM%3C/text%3E%3C/svg%3E)
"Enterprise Admins" is a built-in group in the AD. It's not local to any server or workstation. A "good" security policy would restrict membership in that group pretty severely, and grant and remove members from the group only for the duration of specific tasks. So, I hope that's not really the group you're actually looking for!
Was the group used only to allow you to RDP to individual machines? Or does the group give you permission to access certain filesystem directories or files? Is the group a member of a local group (i.e. in an individual machines SAM)?
The group exists in the AD. You're really looking for where/how it's used on individual machines, and that can take quite a lot of work -- or be pretty simple if you can define HOW the group was used.
The permissions were set up to give R/RW access for the files share.
This is a little old but it should still work.
https://gist.github.com/Juanito99/44bcc30cd96128b0bcf3fc31c6436474
Put that script into a file and use Invoke-Command to run it on each of the servers. You can get the list of servers right from the AD. The only thing you'd need to add to what the script produces is the name of the server to the hash beginning on line 72.