Security Explorer 9.9.2

Revoking Active Directory permissions

You can revoke access for domain users and groups.


	TIP: The Revoke basic task provides a quick way to revoke permissions. See Using the Revoke tasks. For more options, add a path, and click Switch to Security Explorer Classic (Advanced).

To revoke permissions

Open the Active Directory Security module.

Locate the object with the permission to revoke. See Viewing Active Directory permissions.

Right-click selected permission(s), and choose Revoke Permissions.

The Revoke Permissions dialog box displays the path, and the associated groups and users for the current object. The navigation tree is hidden by default. To view the navigation tree, click 4.

Select the domain groups and users to revoke the permission. There are a few methods for selecting groups and users.

•

Choose from the list of domain groups and users in the navigation tree.

•

To filter the list in the left pane, type a server name or base path in the box, and click Set.

•

To return the full list to view, click Reset. The list returns to full view the next time you open Revoke Permissions.

•

Select from the list of domain groups and users associated with the current object.

•

To change to another domain, select the domain from the List Names From list.

•

To display domain users in the list, click Show Users. To return the list to show only groups, click Refresh.

•

Browse for a domain group or user or click Advanced User Selection.

From the Permission list, select the permissions to revoke, and whether or not to Allow or Deny. If the choice is not available in the list, click Advanced Permission Selection to create a custom choice.

Choose options.

Table 1. Revoke options
Option	Description
Revoke all permissions (Allow and Deny) for the selected user	Select to revoke all permissions (Allow and Deny) for the selected user.
Propagate client permissions down to subtree	Select to revoke the specified permissions from the child objects of the client.

To add the domain group/user to the List of users and groups to revoke list, click Add.


	TIP: To add additional domain groups or users to the List of users and groups to revoke list with the selected permission settings, you can hold down CTRL or SHIFT, and click a domain group or user from the list or double-click a group or user in the navigation tree.

Click OK. The Revoking Permissions box displays the progress. See Completing a process.

Cloning Active Directory permissions

Use the Clone feature to copy the permissions of one user/group to another user/group..


	TIP: The Clone task provides a quick way to clone permissions. See Using the Clone task. For more options, add a path, and click Switch to Security Explorer Classic (Advanced).

To clone permissions

Open the Active Directory Security module.

Locate the object with the permission to clone. See Viewing Active Directory permissions.

Select Security | Clone Group or User.

-OR-

Right-click the objects, and choose Clone Group or User.


	NOTE: If the selected object has subnodes, you can select multiple objects in the Objects pane to clone.

The Clone Active Directory Permissions box opens to the Manual User/Group Selection tab and displays the path to the selected object and the associated groups and users.

Select the groups or users to clone. See Selecting users and groups manually.

Select options.

Table 2. Clone options
Option	Description
Clone permissions	By default, permissions are cloned.
Clone group memberships	Select to add the destination account to the groups of which the source user is a member. If you choose this check box, a warning message displays. The destination is cloned into the same parent groups as the source. The contents of the groups selected as the source are not cloned.
Propagate permissions down to subtree	Write over the permissions of the child objects.

Click OK. See Completing a process.

Searching for Active Directory objects


	TIP: The Search basic task provides a quick way to search for permissions. See Using the Search tasks.

To search for Active Directory® objects

Open the Active Directory Security module.

Locate the object to search. See Viewing Active Directory permissions.


	NOTE: If you open the Search tab in the Navigation pane without selecting an object, you need to add a Search Scope before you set criteria. See Adding a search scope.

Select Search | Search in a New Window (Empty).

-OR-

Click

on the Tool Bar; or right-click an object, and choose Search in a New Window.

The object you select is added as a Search Scope so you can just set the criteria for the search.


	NOTE: All selected scopes must be from the same forest.

Table 3. Permission search criteria
Option	Description
Name	Enter or browse for the name of the principal that you want to find. Use * to match any number of characters. Use ? to match any single character. The comparison is not case sensitive.
Include all group memberships	Select to include all group memberships. The groups to which the account belongs appear in the drop-down list.
Permission	You can search for a name or a permission type. If you want to search for permissions, type the permissions in the box separated by commas. Alternatively, browse to select permissions from a list.
Allow Permissions	By default, allow permissions are included in the search results. To exclude allow permissions, clear the check box.
Inherited Permissions	By default, inherited permissions are included in the search results. Inherited permissions are indicated by (I) in the Type column. To exclude inherited permissions, clear the check box.
Deny Permissions	By default, deny permissions are included in the search results. To exclude deny permissions, clear the check box.
Explicit Permissions	By default, explicit permissions are included in the search results. To exclude explicit permissions, clear the check box.
Search for unknown accounts	Select to search for accounts deleted from Active Directory.
Search for disabled accounts	Select to search for disabled accounts.
Search for inheritance-disabled objects	Select to search for inheritance-disabled objects.

Click Start Search.

Use the buttons to manage the results. You can save the search, save the search results, or generate a report.

Table 4. Search tab buttons
Button	Description
Start Search	Start the search based on the current Search Scope and selected criteria.
Stop Search	Stop the search process.
Clear Results	Clear the results area.
Defaults	Return to the default selections on all search criteria tabs.
Save Results	Save the results as a .txt file.
Report	Display the results in a report format that you can save, print, or export.
Schedule	Schedule a search.

Modifying Active Directory permissions

Modify the permissions of groups or users on the selected Active Directory® object. Use this feature for quick changes to accounts displayed in the permissions list. Use the Grant feature to give permissions to accounts that are not displayed in the permissions list. See Granting Active Directory permissions.


	IMPORTANT: You cannot modify inherited permissions directly. Inherited permissions are indicated by Allow (I) in the Type column. To modify these permissions, you must modify the parent object.

To modify permissions

Open the Active Directory Security module.

Locate the object with the permissions to modify. See Viewing Active Directory permissions.

Select the object in the Objects pane or the permissions in the Permissions pane.


	NOTE: If you choose multiple permissions, the selected permissions must be under the same path or object. If the paths are not the same, you receive a warning message.