Access Hoarders, Group Sprawl and Permission Creep: Cleaning up AD

9/19/2019 12:00:00 PM [(UTC-05:00) Eastern Time (US & Canada)] - Can't make the live event? Register anyway to receive a link to the recording.

Other Time Zones

GMT Standard Time-(UTC+00:00) Dublin, Edinburgh, Lisbon, London    9/19/2019 5:00:00 PM
Show/Hide All Time Zones

All Time Zones

Dateline Standard Time-(UTC-12:00) International Date Line West 9/19/2019 4:00:00 AM
UTC-11-(UTC-11:00) Coordinated Universal Time-11 9/19/2019 5:00:00 AM
Aleutian Standard Time-(UTC-10:00) Aleutian Islands 9/19/2019 7:00:00 AM
Hawaiian Standard Time-(UTC-10:00) Hawaii 9/19/2019 6:00:00 AM
Marquesas Standard Time-(UTC-09:30) Marquesas Islands 9/19/2019 6:30:00 AM
Alaskan Standard Time-(UTC-09:00) Alaska 9/19/2019 8:00:00 AM
UTC-09-(UTC-09:00) Coordinated Universal Time-09 9/19/2019 7:00:00 AM
Pacific Standard Time (Mexico)-(UTC-08:00) Baja California 9/19/2019 9:00:00 AM
UTC-08-(UTC-08:00) Coordinated Universal Time-08 9/19/2019 8:00:00 AM
Pacific Standard Time-(UTC-08:00) Pacific Time (US & Canada) 9/19/2019 9:00:00 AM
US Mountain Standard Time-(UTC-07:00) Arizona 9/19/2019 9:00:00 AM
Mountain Standard Time (Mexico)-(UTC-07:00) Chihuahua, La Paz, Mazatlan 9/19/2019 10:00:00 AM
Mountain Standard Time-(UTC-07:00) Mountain Time (US & Canada) 9/19/2019 10:00:00 AM
Central America Standard Time-(UTC-06:00) Central America 9/19/2019 10:00:00 AM
Central Standard Time-(UTC-06:00) Central Time (US & Canada) 9/19/2019 11:00:00 AM
Easter Island Standard Time-(UTC-06:00) Easter Island 9/19/2019 11:00:00 AM
Central Standard Time (Mexico)-(UTC-06:00) Guadalajara, Mexico City, Monterrey 9/19/2019 11:00:00 AM
Canada Central Standard Time-(UTC-06:00) Saskatchewan 9/19/2019 10:00:00 AM
SA Pacific Standard Time-(UTC-05:00) Bogota, Lima, Quito, Rio Branco 9/19/2019 11:00:00 AM
Eastern Standard Time (Mexico)-(UTC-05:00) Chetumal 9/19/2019 11:00:00 AM
Eastern Standard Time-(UTC-05:00) Eastern Time (US & Canada) 9/19/2019 12:00:00 PM
Haiti Standard Time-(UTC-05:00) Haiti 9/19/2019 12:00:00 PM
Cuba Standard Time-(UTC-05:00) Havana 9/19/2019 12:00:00 PM
US Eastern Standard Time-(UTC-05:00) Indiana (East) 9/19/2019 12:00:00 PM
Turks And Caicos Standard Time-(UTC-05:00) Turks and Caicos 9/19/2019 12:00:00 PM
Paraguay Standard Time-(UTC-04:00) Asuncion 9/19/2019 12:00:00 PM
Atlantic Standard Time-(UTC-04:00) Atlantic Time (Canada) 9/19/2019 1:00:00 PM
Venezuela Standard Time-(UTC-04:00) Caracas 9/19/2019 12:00:00 PM
Central Brazilian Standard Time-(UTC-04:00) Cuiaba 9/19/2019 12:00:00 PM
SA Western Standard Time-(UTC-04:00) Georgetown, La Paz, Manaus, San Juan 9/19/2019 12:00:00 PM
Pacific SA Standard Time-(UTC-04:00) Santiago 9/19/2019 1:00:00 PM
Newfoundland Standard Time-(UTC-03:30) Newfoundland 9/19/2019 1:30:00 PM
Tocantins Standard Time-(UTC-03:00) Araguaina 9/19/2019 1:00:00 PM
E. South America Standard Time-(UTC-03:00) Brasilia 9/19/2019 1:00:00 PM
SA Eastern Standard Time-(UTC-03:00) Cayenne, Fortaleza 9/19/2019 1:00:00 PM
Argentina Standard Time-(UTC-03:00) City of Buenos Aires 9/19/2019 1:00:00 PM
Greenland Standard Time-(UTC-03:00) Greenland 9/19/2019 2:00:00 PM
Montevideo Standard Time-(UTC-03:00) Montevideo 9/19/2019 1:00:00 PM
Magallanes Standard Time-(UTC-03:00) Punta Arenas 9/19/2019 1:00:00 PM
Saint Pierre Standard Time-(UTC-03:00) Saint Pierre and Miquelon 9/19/2019 2:00:00 PM
Bahia Standard Time-(UTC-03:00) Salvador 9/19/2019 1:00:00 PM
UTC-02-(UTC-02:00) Coordinated Universal Time-02 9/19/2019 2:00:00 PM
Mid-Atlantic Standard Time-(UTC-02:00) Mid-Atlantic - Old 9/19/2019 3:00:00 PM
Azores Standard Time-(UTC-01:00) Azores 9/19/2019 4:00:00 PM
Cape Verde Standard Time-(UTC-01:00) Cabo Verde Is. 9/19/2019 3:00:00 PM
UTC-(UTC) Coordinated Universal Time 9/19/2019 4:00:00 PM
GMT Standard Time-(UTC+00:00) Dublin, Edinburgh, Lisbon, London 9/19/2019 5:00:00 PM
Greenwich Standard Time-(UTC+00:00) Monrovia, Reykjavik 9/19/2019 4:00:00 PM
Sao Tome Standard Time-(UTC+00:00) Sao Tome 9/19/2019 4:00:00 PM
Morocco Standard Time-(UTC+01:00) Casablanca 9/19/2019 5:00:00 PM
W. Europe Standard Time-(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna 9/19/2019 6:00:00 PM
Central Europe Standard Time-(UTC+01:00) Belgrade, Bratislava, Budapest, Ljubljana, Prague 9/19/2019 6:00:00 PM
Romance Standard Time-(UTC+01:00) Brussels, Copenhagen, Madrid, Paris 9/19/2019 6:00:00 PM
Central European Standard Time-(UTC+01:00) Sarajevo, Skopje, Warsaw, Zagreb 9/19/2019 6:00:00 PM
W. Central Africa Standard Time-(UTC+01:00) West Central Africa 9/19/2019 5:00:00 PM
Jordan Standard Time-(UTC+02:00) Amman 9/19/2019 7:00:00 PM
GTB Standard Time-(UTC+02:00) Athens, Bucharest 9/19/2019 7:00:00 PM
Middle East Standard Time-(UTC+02:00) Beirut 9/19/2019 7:00:00 PM
Egypt Standard Time-(UTC+02:00) Cairo 9/19/2019 6:00:00 PM
E. Europe Standard Time-(UTC+02:00) Chisinau 9/19/2019 7:00:00 PM
Syria Standard Time-(UTC+02:00) Damascus 9/19/2019 7:00:00 PM
West Bank Standard Time-(UTC+02:00) Gaza, Hebron 9/19/2019 7:00:00 PM
South Africa Standard Time-(UTC+02:00) Harare, Pretoria 9/19/2019 6:00:00 PM
FLE Standard Time-(UTC+02:00) Helsinki, Kyiv, Riga, Sofia, Tallinn, Vilnius 9/19/2019 7:00:00 PM
Israel Standard Time-(UTC+02:00) Jerusalem 9/19/2019 7:00:00 PM
Kaliningrad Standard Time-(UTC+02:00) Kaliningrad 9/19/2019 6:00:00 PM
Sudan Standard Time-(UTC+02:00) Khartoum 9/19/2019 6:00:00 PM
Libya Standard Time-(UTC+02:00) Tripoli 9/19/2019 6:00:00 PM
Namibia Standard Time-(UTC+02:00) Windhoek 9/19/2019 6:00:00 PM
Arabic Standard Time-(UTC+03:00) Baghdad 9/19/2019 7:00:00 PM
Turkey Standard Time-(UTC+03:00) Istanbul 9/19/2019 7:00:00 PM
Arab Standard Time-(UTC+03:00) Kuwait, Riyadh 9/19/2019 7:00:00 PM
Belarus Standard Time-(UTC+03:00) Minsk 9/19/2019 7:00:00 PM
Russian Standard Time-(UTC+03:00) Moscow, St. Petersburg 9/19/2019 7:00:00 PM
E. Africa Standard Time-(UTC+03:00) Nairobi 9/19/2019 7:00:00 PM
Iran Standard Time-(UTC+03:30) Tehran 9/19/2019 8:30:00 PM
Arabian Standard Time-(UTC+04:00) Abu Dhabi, Muscat 9/19/2019 8:00:00 PM
Astrakhan Standard Time-(UTC+04:00) Astrakhan, Ulyanovsk 9/19/2019 8:00:00 PM
Azerbaijan Standard Time-(UTC+04:00) Baku 9/19/2019 8:00:00 PM
Russia Time Zone 3-(UTC+04:00) Izhevsk, Samara 9/19/2019 8:00:00 PM
Mauritius Standard Time-(UTC+04:00) Port Louis 9/19/2019 8:00:00 PM
Saratov Standard Time-(UTC+04:00) Saratov 9/19/2019 8:00:00 PM
Georgian Standard Time-(UTC+04:00) Tbilisi 9/19/2019 8:00:00 PM
Volgograd Standard Time-(UTC+04:00) Volgograd 9/19/2019 8:00:00 PM
Caucasus Standard Time-(UTC+04:00) Yerevan 9/19/2019 8:00:00 PM
Afghanistan Standard Time-(UTC+04:30) Kabul 9/19/2019 8:30:00 PM
West Asia Standard Time-(UTC+05:00) Ashgabat, Tashkent 9/19/2019 9:00:00 PM
Ekaterinburg Standard Time-(UTC+05:00) Ekaterinburg 9/19/2019 9:00:00 PM
Pakistan Standard Time-(UTC+05:00) Islamabad, Karachi 9/19/2019 9:00:00 PM
Qyzylorda Standard Time-(UTC+05:00) Qyzylorda 9/19/2019 9:00:00 PM
India Standard Time-(UTC+05:30) Chennai, Kolkata, Mumbai, New Delhi 9/19/2019 9:30:00 PM
Sri Lanka Standard Time-(UTC+05:30) Sri Jayawardenepura 9/19/2019 9:30:00 PM
Nepal Standard Time-(UTC+05:45) Kathmandu 9/19/2019 9:45:00 PM
Central Asia Standard Time-(UTC+06:00) Astana 9/19/2019 10:00:00 PM
Bangladesh Standard Time-(UTC+06:00) Dhaka 9/19/2019 10:00:00 PM
Omsk Standard Time-(UTC+06:00) Omsk 9/19/2019 10:00:00 PM
Myanmar Standard Time-(UTC+06:30) Yangon (Rangoon) 9/19/2019 10:30:00 PM
SE Asia Standard Time-(UTC+07:00) Bangkok, Hanoi, Jakarta 9/19/2019 11:00:00 PM
Altai Standard Time-(UTC+07:00) Barnaul, Gorno-Altaysk 9/19/2019 11:00:00 PM
W. Mongolia Standard Time-(UTC+07:00) Hovd 9/19/2019 11:00:00 PM
North Asia Standard Time-(UTC+07:00) Krasnoyarsk 9/19/2019 11:00:00 PM
N. Central Asia Standard Time-(UTC+07:00) Novosibirsk 9/19/2019 11:00:00 PM
Tomsk Standard Time-(UTC+07:00) Tomsk 9/19/2019 11:00:00 PM
China Standard Time-(UTC+08:00) Beijing, Chongqing, Hong Kong, Urumqi 9/20/2019 12:00:00 AM
North Asia East Standard Time-(UTC+08:00) Irkutsk 9/20/2019 12:00:00 AM
Singapore Standard Time-(UTC+08:00) Kuala Lumpur, Singapore 9/20/2019 12:00:00 AM
W. Australia Standard Time-(UTC+08:00) Perth 9/20/2019 12:00:00 AM
Taipei Standard Time-(UTC+08:00) Taipei 9/20/2019 12:00:00 AM
Ulaanbaatar Standard Time-(UTC+08:00) Ulaanbaatar 9/20/2019 12:00:00 AM
Aus Central W. Standard Time-(UTC+08:45) Eucla 9/20/2019 12:45:00 AM
Transbaikal Standard Time-(UTC+09:00) Chita 9/20/2019 1:00:00 AM
Tokyo Standard Time-(UTC+09:00) Osaka, Sapporo, Tokyo 9/20/2019 1:00:00 AM
North Korea Standard Time-(UTC+09:00) Pyongyang 9/20/2019 1:00:00 AM
Korea Standard Time-(UTC+09:00) Seoul 9/20/2019 1:00:00 AM
Yakutsk Standard Time-(UTC+09:00) Yakutsk 9/20/2019 1:00:00 AM
Cen. Australia Standard Time-(UTC+09:30) Adelaide 9/20/2019 1:30:00 AM
AUS Central Standard Time-(UTC+09:30) Darwin 9/20/2019 1:30:00 AM
E. Australia Standard Time-(UTC+10:00) Brisbane 9/20/2019 2:00:00 AM
AUS Eastern Standard Time-(UTC+10:00) Canberra, Melbourne, Sydney 9/20/2019 2:00:00 AM
West Pacific Standard Time-(UTC+10:00) Guam, Port Moresby 9/20/2019 2:00:00 AM
Tasmania Standard Time-(UTC+10:00) Hobart 9/20/2019 2:00:00 AM
Vladivostok Standard Time-(UTC+10:00) Vladivostok 9/20/2019 2:00:00 AM
Lord Howe Standard Time-(UTC+10:30) Lord Howe Island 9/20/2019 2:30:00 AM
Bougainville Standard Time-(UTC+11:00) Bougainville Island 9/20/2019 3:00:00 AM
Russia Time Zone 10-(UTC+11:00) Chokurdakh 9/20/2019 3:00:00 AM
Magadan Standard Time-(UTC+11:00) Magadan 9/20/2019 3:00:00 AM
Norfolk Standard Time-(UTC+11:00) Norfolk Island 9/20/2019 3:00:00 AM
Sakhalin Standard Time-(UTC+11:00) Sakhalin 9/20/2019 3:00:00 AM
Central Pacific Standard Time-(UTC+11:00) Solomon Is., New Caledonia 9/20/2019 3:00:00 AM
Russia Time Zone 11-(UTC+12:00) Anadyr, Petropavlovsk-Kamchatsky 9/20/2019 4:00:00 AM
New Zealand Standard Time-(UTC+12:00) Auckland, Wellington 9/20/2019 4:00:00 AM
UTC+12-(UTC+12:00) Coordinated Universal Time+12 9/20/2019 4:00:00 AM
Fiji Standard Time-(UTC+12:00) Fiji 9/20/2019 4:00:00 AM
Kamchatka Standard Time-(UTC+12:00) Petropavlovsk-Kamchatsky - Old 9/20/2019 5:00:00 AM
Chatham Islands Standard Time-(UTC+12:45) Chatham Islands 9/20/2019 4:45:00 AM
UTC+13-(UTC+13:00) Coordinated Universal Time+13 9/20/2019 5:00:00 AM
Tonga Standard Time-(UTC+13:00) Nuku'alofa 9/20/2019 5:00:00 AM
Samoa Standard Time-(UTC+13:00) Samoa 9/20/2019 5:00:00 AM
Line Islands Standard Time-(UTC+14:00) Kiritimati Island 9/20/2019 6:00:00 AM

Webinar Registration

In classic on-prem AD domains, the number of groups often approached parity with the number of user accounts. With Microsoft Teams and Office 365 Groups, the number of groups is going to just keep growing. Along with those groups come entitlements and too much authority. This means that malicious insiders can do more damage the longer they are at a firm, and that attackers who gain control of an account are more likely to have access to what you are trying to protect. 

Why are there so many groups in the first place? Most networks are over 20 years old and most organizations migrated to Active Directory from NT 4.0, Novell and even Banyan Vines. Coexistence has always been a factor in regards to a migration and most organizations focus on completing a project with the least amount of impact, however there is a cost associated with speed. Being that groups provide authorization for files and folders, most organizations migrated many groups from legacy environments instead of determining why those groups were created in the first place. Once these groups exist in your directory, it becomes even more challenging to know what they are being used for. Groups could be used to provide access for an application, email distribution, or file and folder access.

Bryan Patton, a colleague at Quest, told me how while watching an episode of “Hoarders” with his wife, he noticed himself relating this to many of the Active Directory environments that he’s seen over the years. Just as a hoarder doesn’t want to get rid of objects as they feel that it may have value for them later, one must realize that having too many objects without a purpose can be damaging. With the ability to nest groups, it becomes quite challenging to answer the question, “what does this person have access to?” To answer that question, you have to know if that person’s user objects has explicit access anywhere, but also break down any group memberships that may be applied (and those groups may be members of other groups).

Usually, in each episode of “Hoarders” there is a psychologist involved to help facilitate the process to achieve satisfactory and sustainable results. Information Security Polices serve a similar role when addressing a cleanup in AD. Just as many people resist getting the help they need, and by seeing a psychologist they get help in understanding “why” they are hoarding, most organizations lack any governance (established by Information Security Policies) over groups to establish who should be in a group and if that groups purpose is still relevant.

With the abundance of organizations now using Office 365, the amount of groups will continue to grow. Azure AD Connect synchronizes groups from On-premise Active Directory to Azure Active Directory and there is also the ability to create Office 365 groups. Left unmanaged, the proliferation of groups will continue.

Bryan works with a lot of companies to help them clean up their Active Directory – especially with regard to getting control of their groups. In this real training for free event, Bryan will show us the process he and his team has developed to accomplish this, which is roughly broken down into the following steps:

  1. Assessment
  2. Implement entitlement management process
  3. Cleaning up unneeded permissions
  4. Deleting/combining redundant groups
  5. Ongoing group and entitlement maintenance

Decluttering the years of legacy junk can be time consuming and painful, and keeping it clean is an ongoing challenge. Unfortunately, there is not a fancy new technology that will magically tidy years of entangled systems, processes and groups – preparation, persistence and hard work is necessary. However, by putting these practices and solutions in place, organizations can reduce complexity and confusion in your environment and eliminate the inherent risk these unmanaged users and groups represent.

Bryan, will briefly show how Quest’s fleet of AD and Windows management solutions help automate the drudgery of every aspect of this process.

Please join us for this real training for free session.

First Name:   
Last Name:   
Work Email:  
Phone:  
Job Title:  
Organization:  
Country:    
Address:  
City:  
State:  
Zip/Postal Code:  
Public sector:
Company Size:
 

Your information will be shared with the sponsor.

By clicking "Submit", you're agreeing to our Privacy Policy and consenting to be contacted by us.

 

 

Additional Resources