Because of the lack of attention groups get throughout their lifetime, one of the greatest security risks an organization faces is when a group lives too long. Think about it – you have groups that exist today that, despite having a clear understanding of the logic behind its membership, you have zero idea why it’s…
One of the greatest faults in the architecture of AD is the complete lack of documenting when someone assigns permissions to it. You know what I’m talking about – you’re in SharePoint, or on a file server and you add some permissions to a resource. You grab a list of users and groups from AD,…
If I was to ask you who are the members of a given group with permissions to some sensitive application or data set (one other than, say, Domain Admins), you probably don’t know the answer to that. It’s a bit of an unfair question, as none of us strive to memorize the membership of any…
We’ve spent a lot of time and effort on this blog working to educate you on best practices around specific aspects of AD group management, such as roles for delegation, the use of dynamic memberships, defining Active Directory health, and more. All of these blogs are part of a larger view of groups – one…
I recently wrote about the cost of managing Active Directory groups, where a look was taken at how calculating what it truly costs your organization to manage groups within AD. For organizations large and small, the costs (relatively speaking) are material. And those material costs only revolve around IT reacting to the requested changes made…
In keeping with our mantra of Better Groups, Better Security, we look for great ways you can improve your security through better group management. While the amount of work needed to add a single user to a group takes the smallest of efforts, it’s when you make a conscious effort to improve the security of…