The world's most trusted forum on Active Directory Security

Post Info TOPIC: How to check / verify delegations in Active Directory


Posts: 3
Date: Jan 3, 2013
How to check / verify delegations in Active Directory

Hello Forum,

I work for a small IT consulting firm and we help our clients (mostly medium-size organizations) manage most aspects of their Active Directory deployments. We leverage the knowledge and experience we gain from all our customer's deployments to help other clients as well.

Recently we have seen an increase in the requirement by many of our customers wherein they are asking us to help them check / verify delegations in their Active Directory deployments. From what I understand, a combination of external audit requirements and the need for implementing least privileged access (LPA) is driving them to get more clarity into delegations made in their ADs.

While we have done some work on Active Directory security, most of it has been on designing and rolling out delegation models for these clients. We never felt the need to check / verify these delegations because we figured they would end up rolled out just as we had intended. However, it turns out that in more than one cases, they have accidentally found excessive access granted.

So I am trying to figure out how to check / verify delegations in Active Directory.

Is it simply a matter of looking at individual permissions on Active Directory objects, or is there something more to it? or, for example, is it just a matter of recursively enumerating administrative group memberships, or is there more than that to it?

We absolutely want to help our customers, and at the same time, we need to ensure that this can be done efficiently without taking up lots of time and effort, because even though we bill our customers for our time, I doubt they'd be willing to approve a project that takes 100s of hours.

Is there an easy and/or efficient way to check / verify delegations in Active Directory?

Thanks for your help.



"These young guys are playing checkers. I'm out there playing chess" - Kobe Bryant

Page 1 of 1  sorted by
Quick Reply

Please log in to post quick replies.

Post to Digg Post to
Members Login
    Remember Me