AD Groups tidy

Question

Hi

Im looking to see what we can do to keep our Active directory groups under control.

e.g. We can query users to see who has not logged on in 6 months but can really do the same with Groups.

Im looking to remove groups that are no longer needed.

Im musing that I could filter for all groups with no members to begin with and remove those.

e.g. could filter on all groups with no descriptions and pursue those.

I see that we have e.g. 400 users but 1000 groups.

Logically Im thinking there should be more users than groups but perhaps there is something Im missing.

What would we recommend to get groups trimmed down to only what's necessary.

Im happy to use PowerShell to achieve where applicable.

Thanks

Answer 1

Just some thoughts from several decades of managing *nix email, MS Mail, and Exchange:

Start by asking the group's manager(s) whether the group is still necessary. If the group's manager is no longer an employee, find a new manager for the group.

Groups without members may be legitimate. I used to use them for the purpose of simply dropping messages that were replies to e-mail sent with a "do-not-reply" address.

Use the message tracking logs and find the events that correspond to the expansion of a DL. Keep the information in a small database (XML would be good for this, although a CSV could also work). It the group hasn't been used (i.e., expanded) in some time, consider it a good candidate for further investigation.