Everyone’s worried about endpoints. And you should. As evidenced by the rise in organizations experiencing attacks via malware-laden websites, phishing and spear phishing, and OS/application vulnerabilities, the endpoint is a clear target for external attackers. Compromising an endpoint is frequently the first step needed to gain a foothold within your organization’s network, giving these attackers…
Face it. Consolidating groups is just one of those tasks no one really wants to take on. You know that your Active Directory is filled with a ton of unused or unnecessary groups, yet they still sit there, happily existing without any supervision. See if any of these situations sound familiar: A group with no…
Who’s in charge here, anyway? Even if you have only a modicum of proper group management in place, your groups should at very least have some documentation of (a) how a given group is being used in the Notes field and (b) who is responsible for the group in the Managed By field, for the…
If you’re like most IT professionals, you don’t bother to update an Active Directory group’s membership. What’s the big deal? You may have read our articles about the realities of IT not focusing on groups or about the importance of putting some basic management in place — or better yet, a full group management lifecycle…
According to the 2015 Verizon Data Breach Investigations Report, approximately 85% of data breaches are performed by an external threat actor, with approximately 45% of those breaches focusing on credentials. This makes sense. Without proper credentials, the threat actor won’t be able to access the target data they want. Most threat actors gain entry by…
When’s the last time you actually managed your Active Directory groups? Be honest. We’re not talking about that last time you added someone to a group. We’re talking about the last time you actually did some homework to ensure that the group had the right members, that the permissions were assigned correctly, etc. It’s probably…
Group management in Active Directory is so much more than just making sure that memberships are correct. There’s an entire lifecycle process devoted to improving the management of groups — and the security they represent. But for many of you, there simply isn’t enough time (yet) to devote to implementing an entire group lifecycle. So,…
While they’ve been around for decades, in recent years we’ve all been introduced to squatters — people who move into an empty house that isn’t theirs and then take full advantage of the benefits of having a place to stay. They obtain utilities, setup mail delivery, maybe even meet the neighbors — all the while…
We are all well aware of the theory that every person is separated from everyone else by only six people. In fact, one 2013 study showed that this separation was just a little over 3.5 people. Although not as widely recognized, there is also a degree of separation between the people in IT who establish…
In some ways, there is no greater threat to security than a temp employee. At first glance, the previous statement might not make much sense. After all, the temp has comparatively the least amount of privileges, and they have those privileges for only a short period of time. In reality, however, the accounts created for…
Whenever the topic of moving to the cloud comes up, it’s inevitable that the topic of security also arises. And rightly so: the cloud can create a host of security risks concerning who has access to services and data, from both an IT and an end-user perspective. A recent article on SharePoint adoption cited the…
If you were asked, “Is your environment secure?” you’d probably respond with something like “more or less.” After all, we IT professionals are pretty logical, and while we make a solid effort, there are areas of our network environments that are in less-than-desirable shape. You have a lot on your plate, and you just don’t…
It’s been said that admitting that you have a problem is the first step on the road to recovery. So let’s all take a deep breath, and say it together: My groups are a mess. Come on… I know you can do it. Don’t believe your groups are a mess? Let’s take a look at…
It seems that any tasks that are “tech-related” fall into the hands of IT. It’s been that way as long as I can remember. Managing groups in Active Directory is no different: It is something that IT takes care of — mostly because groups exist within a system (Active Directory) for which most users haven’t…
When I was a kid, I remember playing in my room for hours on end, playing with new toy after new toy. Of course, being a kid, I never put anything away, so the number of toys just sitting around kept growing and growing. When my parents finally saw that my floor was riddled with…
In today’s IT support model, the service desk/help desk often represents the focal point for all users to bring their needs and issues to IT. Need your password reset? Call the service desk. Need to be added to an AD group so you can get your job done? Call the service desk. Need your last…
If you’re like most IT professionals, after a group is created, you never really give that group a second thought. Once you go to the Members tab, add a user or two, and press OK, you don’t look back. It makes sense — it’s just groups, right? I mean, who cares? Perhaps the better question…
In previous articles, we’ve discussed the reasons why IT often doesn’t pay attention managing groups in Active Directory (AD), as well as how security threats can arise from not doing so. In this article, we are going to review the steps required to manage groups in AD effectively and efficiently. Before we start, let’s establish…
In the article “Are Insider Threats IT’s Fault?,” I discussed how the lack of focus on permissions granted by groups in Active Directory (AD) could be a contributing factor to insider threats and pose a potential security risk. With over one-third of organizations reporting that they do not implement any kind of least-privilege model1, this…
Asking this question might be considered edgy, so I’ll start by answering: No. Well, not exactly — not on purpose anyway. As an IT professional, you might ask yourself, “Seriously? Insider Threats are my fault?” I’m certainly not trying to alienate you. I’ve been in IT for over 20 years and know the hard work…
Managing Active Directory groups is probably one of the simplest tasks you perform on a regular basis. It’s right up there with resetting a password. Because it takes little effort — and even less thought — it can often be easily dismissed as a routine, unimportant task. In a recent webinar I hosted with Imanami,…
If you were to ask what’s the most difficult part of managing Active Directory groups, we’d probably get a few different answers. Probably very few of you (if any at all) would focus on the actual creation and maintenance of the groups, while most (again, if not all) would focus on the issue of where…
Active Directory Management Wasting Your Time? If you are like millions of other people in this world, when you look at yourself and how you manage time you may come to the conclusion that you are a procrastinator, a day-dreamer, or just someone who wastes their daylight hours on tasks that are not well prioritized.…
Appreciation of admins through delegation of control An anecdotal story of how one company showed appreciation for secretaries and admins In honor of Administrative Professional’s Day (Secretaries Day or Admin Day), I wanted to share an experience I had while talking to one of our customer’s recently. It is after all, these very important people…
Maintaining a Healthy Active Directory I love pizza. Pizza is often cited as the most popular food in the world. Who can blame the world for loving pizza? It has the perfect blend of things that appeal to most people. Zesty tomato based sauce, hot melted cheese, a crust that could melt in your mouth if…
Ensuring that the Right People have the Right Access to the Right Information at the Right Time Defining system access for employees can be a challenging task for organizations of all sizes. But unless intimate knowledge of each employee’s role is known, granting access is often cumbersome and demands manual input from the IT department.…
Managing Groups in the Office 365 Cloud Projecting your on-premise Active Directory groups into your Office 365 hosted Exchange You still need Active Directory even though you have outsourced Exchange to Microsoft via Office 365. So, how do you manage it? You want your user attributes to be accurate, group memberships up to date, unused…
The difference between a successful person and others is not a lack of strength, not a lack of knowledge, but rather a lack of will. – Vince Lombardi Organization through automation and delegation is key to success The sport of American football has its games played on a field called a gridiron. Success on…
with Active Directory Groups – Part 3 When Users need to control their own SharePoint portals, delegate Active Directory group membership management One of the best practices as it relates to group management is to delegate what you cannot automate. This concept is true especially when you’re an organization that uses SharePoint and want to move…
Groups are your cornerstone You cannot build your identity house without a solid identity foundation. Have you ever found yourself with an idea that grows in scope until the original idea has morphed into one that does not accomplish the original intention of the idea? This type of scope bloat is typical for many IT…
The Case for Linked Identities I am but one person and my computer does not recognize me. That is the feeling many get while attempting to attest to some application or service. Keeping your identity protected is necessary and we do this typically behind a password firewall that verifies we are who we say we are.…
The case for temporary membership You are sitting around a table to discuss the current status of a critical project. Things are not looking real good and it seems that there is no way to reach the end of the project by the necessary deadline with the staff currently tasked with the work. There is…
with Active Directory Groups – Part 2 Use GroupID to leverage ABAC concepts for intelligent SharePoint memberships. What you know about your staff is usually what drives identifying what resources they need in order to be productive. For example, you may know that a person who works in your Chicago office and is responsible for…
with Active Directory Groups – Part 1 SharePoint is one of the fastest growing applications in the enterprise. It has many uses and some of those uses have given rise to its popularity such as a collaborative tool for small groups of people, being used as a document repository, and a centralized communications portal for…
Ensuring a Group Management Best Practice Building on the blog of “the case for multiple owners“, the concept of multiple owners with Active Directory Groups becomes of lesser value if those who you’ve delegated group creation to do not actually establish an owner or additional ownership as part of the creation process. Now considered a…
Getting email addresses from here to there and back again Active Directory is ever increasingly becoming the center-piece technology on which corporate identity strategies depend on. Orbiting Active Directory identities are the needs to provision those identities along with the applications that then consume those same identities to provide access and services. The art of successful provisioning is…
Avoid planetary disasters – Quickly bridge two organizations What happens when two organizations decide to merge or when a larger enterprise envelopes a smaller organization? Without a plan in place for an effective integration, the two organization are bound for disaster from an IT perspective. Much like two planetary objects colliding in space. It can…
We are all surrounded by dummies. Be Active Directory smart. There are many experts in our field. I could not start naming them without leaving someone off what would be a very lengthy list of people I look up to. What I enjoy about knowing a little bit about these intelligent people is that they…
Securing Active Directory Groups in the Cloud NASA made a revelation recently revealed that their attempts at moving to the cloud introduced security gaps. This came about after an internal review by NASA’s inspector general. Servers, files, and other resources were without the protections that had previously been in place with on-premise based controls. The…
Active Directory Groups are used for many different purposes. Whether it be for managing security through membership in security groups or be it at establishing simple group communications through distribution groups (lists), groups provide an excellent method to logically assemble related objects together. The term “orphan” can carry with it a negative connotation. No person,…
A customer asked recently, do you have any “best practices” in terms of naming your groups? To properly answer the question, we had to first understand why they were asking the question. After some discussion, we determined that they were just looking to find purpose and meaning to groups that were created before they were…
Back when your company was smaller, Active Directory group management was easy. You simply put new people into active directory and manually assigned them to groups so they were included in email and had permission to access resources like files and printers. Resetting passwords, responding to the HR emails, and getting everyone quickly online and…
Max Wertheimer, the founder of the Gestalt Theory once stated in a borrowed and commonly referenced Aristotle philosophy that “The whole is greater than the sum of its parts”. This observation states that at times, two entities can collectively be of greater benefit or value than what would be possible with their value independently. This…
Just as Active Directory has a user object for each network user, it has a computer object for each computer in the domain. These objects are treated as an account. As with user accounts, computer accounts provide a means for authenticating and auditing the computer’s access to the network and its access to domain resources.…
In role based access control, security groups and distribution lists will by design, have specific associations to resources based on the need to apply a certain job function, task, or action to specific classifications of workers. The membership of security groups and/or distribution lists are adeptly managed using object attributes stored in Active Directory with…
Imanami has been saving companies money for 12 years by providing purpose-built solutions for Active Directory Group Management that automate the manual processes of managing Exchange distribution lists and security groups. On average, our customers achieve Return on Investment in a few months after purchasing and installing our automation products. The savings are seen in…
Imanami Active Directory Management Software is based on feedback from CIOs and IT Managers every step of the way. We get the feedback about market needs because we ask. We host online forms and chat rooms to discuss issues with our customers and would-be customers. Imanami’s CEO and Chief Software Architect, Robert Haaverson, makes no…
Active Directory Group Management solutions can make all the difference in the day-to-day life of an IT Manager and everyone else in the company. As we all know, there are two ways to manage any department. The first management style is “Putting out Fires” the second is “Proactively Managing” by anticipating problems based on past performance,…
Active Directory does an excellent job of allowing administrators to arrange their security identities in a hierarchal fashion. In a previous blog post , we discussed nested security groups which can be used to implement inherited security permissions. Active Directory also allows you to structure your Active Directory Organizational Units (OU for short) to…
Many organizations still follow the traditional practice of writing or printing passwords on paper and keeping them in a physical vault, which would remain under the control of the IT department. When you have issues with your password or you need to unlock your account, you will have to either track the person who may…