"Active" Active Directory groups

Question

Hello All

We have a question in regards to checking the Active Directory forest for currently active groups. With the automation process begininning for adding groups to each person based on their jobCode, we need to weed out the groups that don't actually control anything anymore. We are looking for a suggestion, script or tool on how to accomplish this so we can weed out the groups that do not control anything.

Thank you

Comments

Hello,

Could you specify exactly which groups should be deleted? How do we define that a group is inactive?

---

Our AD structure has been in place for many years and many incarnations of Admins before me. We know we have a few group (Office or internet) that were created way back when and no longer control anything in our environment. We are looking to discontinue using these groups and wanted to find all the groups that have been orphaned and no longer control anything.

---

Hello,

find all the groups that have been orphaned and no longer control anything

How exactly do you define these groups? Are these groups that have no Security Roles assigned?

As a solution, you can delete all the groups created more than a certain number of days ago. Does it meet your needs?

---

Sorry, that would not meet our needs. We need to be able to verify without breaking the entire organization, that groups that do not control anything can be disabled and then turned off. We were looking to see if we had a way to check for groups to be "called" upon in AD.

---

Hello,

Sorry, but we don't quite get which groups you want to delete? There is no such notion as 'active' or 'inactive' groups in AD, so you need to define it yourself. Maybe, you are searching for a way to clean up groups without any members in them? What are the criteria? Please explain.

---

Ok, we are gong a different way to test "active"groups. Sorry for any confusion.