If everyone who built the environment is gone and your documentation is very limited. How would you work out what each ad groups purpose is?

Posted by OtiseMaleModel@reddit | sysadmin | View on Reddit | 15 comments

Looking for help here. My first sys admin role and working out what these ad groups do and are used for is an upcoming task and I'd just like to know how a veteran would approach the situation. K12 environment If that makes a difference

Reply to Post

15 Comments

[-]

dojalav578@reddit

BloodHound is used by Security teams and criminals. You can use it to get more insight of your environment. You can backup your AD, restore in VM with no NICs attached and play with it.

[-]

wideace99@reddit

I wonder why are gone those who build it and left no documentation :)

[-]

OtiseMaleModel@reddit (OP)

Documentation systems were brought in not long before they left I'd say. Most of them were around for a while. And there has been systems that have remnants that have since been replaced.

[-]

ThirstyOne@reddit

Try to match the names and descriptions to departments/buildings. There are also tools you can purchase to correlate ad groups to file/folder permissions. Varonis is one such tool, but it’s way overkill for what you’re trying to do. Good product though. How did it happen that an entire K12 tech team is suddenly gone? Did a meteorite hit or something?

[-]

FlatusGiganticus@reddit

Turn it off an see who screams. :)

[-]

dreadpiratewombat@reddit

Also works well for un-labeled servers in the DC racks. I had six racks full of hardware that, apparently, had been someone’s dev sandbox a couple years ago and nobody opted to repurpose, label or even turn them off when that project ended.

[-]

FlatusGiganticus@reddit

Been there. After asking around for days nobody claimed the hardware, so I unplugged the network cable. 5 minutes later the owner found me. Problem solved.

[-]

GullibleDetective@reddit

Diagnoses by echo location (screams)

[-]

Top-Secret-Document@reddit

how many do you turn off at once tho?

[-]

FlatusGiganticus@reddit

The simple way would be one at a time. A more efficient way would be a binary tree where you turn off one half and then the other, tracking the effects, and then half of half etc. You'll get a solid map much faster, but it takes a bit more work.

[-]

tucniak@reddit

This is the way.

[-]

Kritchsgau@reddit

Yeah it’s scary, decomming groups. Get a good audit of file shares, Dump the memberships. Stripping membership is a safe way to find out as this doesnt screw the sid. Deleting the group means you have no idea what that was tied to.

[-]

jeezarchristron@reddit

You could start with the GPOs and see what groups they are linked to.

[-]

OtiseMaleModel@reddit (OP)

Good idea!

[-]

MrGuvernment@reddit

First off, you need an inventory of all devices in the environment, servers, user devices, perimeter (firewalls), anything that is AD / LDAP joined and could be using groups for access. Then, knowing what devices you have, you could start, via various methods, checking each system (windows it is easy) to scan the OS and find out what users / groups are in the local OS groups. The scream test can work for ones you really cant tell. You could also get tools like ManageEngine ADAudit to start logging and tracking things. In the end, you need to know the security group, what it is configured on. Sometimes you can tell by looking at who, if anyone, is even in those security groups.... Go through GPO's and look for any groups that are pushed out via GPO to devices, that would be a quick one off the bat.