Security Explorer 9.8

Searching for Active Directory objects


	TIP: The Search basic task provides a quick way to search for permissions. See Using the Search tasks.

To search for Active Directory® objects

Open the Active Directory Security module.

Locate the object to search. See Viewing Active Directory permissions.


	NOTE: If you open the Search tab in the Navigation pane without selecting an object, you need to add a Search Scope before you set criteria. See Adding a search scope.

Select Search | Search in a New Window (Empty).

-OR-

Click

on the Tool Bar; or right-click an object, and choose Search in a New Window.

The object you select is added as a Search Scope so you can just set the criteria for the search.


	NOTE: All selected scopes must be from the same forest.

Table 3. Permission search criteria
Option	Description
Name	Enter or browse for the name of the principal that you want to find. Use * to match any number of characters. Use ? to match any single character. The comparison is not case sensitive.
Include all group memberships	Select to include all group memberships. The groups to which the account belongs appear in the drop-down list.
Permission	You can search for a name or a permission type. If you want to search for permissions, type the permissions in the box separated by commas. Alternatively, browse to select permissions from a list.
Allow Permissions	By default, allow permissions are included in the search results. To exclude allow permissions, clear the check box.
Inherited Permissions	By default, inherited permissions are included in the search results. Inherited permissions are indicated by (I) in the Type column. To exclude inherited permissions, clear the check box.
Deny Permissions	By default, deny permissions are included in the search results. To exclude deny permissions, clear the check box.
Explicit Permissions	By default, explicit permissions are included in the search results. To exclude explicit permissions, clear the check box.
Search for unknown accounts	Select to include accounts deleted from Active Directory.
Search for disabled accounts	Select to include accounts that are disabled.

Click Start Search.

Use the buttons to manage the results. You can save the search, save the search results, or generate a report.

Table 4. Search tab buttons
Button	Description
Start Search	Start the search based on the current Search Scope and selected criteria.
Stop Search	Stop the search process.
Clear Results	Clear the results area.
Defaults	Return to the default selections on all search criteria tabs.
Save Results	Save the results as a .txt file.
Report	Display the results in a report format that you can save, print, or export.

Modifying Active Directory permissions

Modify the permissions of groups or users on the selected Active Directory® object. Use this feature for quick changes to accounts displayed in the permissions list. Use the Grant feature to give permissions to accounts that are not displayed in the permissions list. See Granting Active Directory permissions.


	IMPORTANT: You cannot modify inherited permissions directly. Inherited permissions are indicated by Allow (I) in the Type column. To modify these permissions, you must modify the parent object.

To modify permissions

Open the Active Directory Security module.

Locate the object with the permissions to modify. See Viewing Active Directory permissions.

Select the object in the Objects pane or the permissions in the Permissions pane.


	NOTE: If you choose multiple permissions, the selected permissions must be under the same path or object. If the paths are not the same, you receive a warning message.

Select Security | Modify Permission.

-OR-

Right-click the permissions, and choose Modify Permission.

Select the principal name, if necessary.

Select the permission role, if necessary.

Select how to apply the permission, if necessary.

Modify the current permissions.

Select whether to modify permissions on child objects.

Table 5. Modify options

Option

Description

Propagate modifications down to subtree

The selected modifications are propagated to child objects.

•

If the child object does not have the selected modified permission, it is granted to the child object.

•

If the child object has the selected modified permission and the modification is less than the parent object, the permission is revoked.

•

If the child object has the selected modified permission and the permission is greater than the parent object, the permission is not changed.

Click OK.

You are asked to verify that the selected permissions will be revoked and the new permissions you selected will be granted.

Click Yes.

Modifying group memberships

To modify group memberships

Open the Active Directory Security module.

Display the permissions for a selected object. See Viewing Active Directory permissions.

In the Permissions pane, select a group or user. You can view the members of a group or view the groups of which the user is a member.

•

To view the members of a selected group, select Tools | Display Group Contents.

-OR-

Click Contents in the Control Button Bar; or right-click a group, and choose Display Group Contents

•

To view the groups of which a selected user is a member, select Tools | Display Memberships.

-OR-

Right-click a user and choose Display Memberships.

Use the buttons to modify the group memberships.

Table 6. Modify group membership options
Button	Description
Add	Add members to the selected group.
Remove	Remove selected members from the selected group.
Refresh	Refresh the list after adding or removing a member.
Print	Print the list.
Save	Save the list as a .txt file.
Show Group Contents	View the members of a selected group.
Show Memberships	Show the groups of which the selected group or user is a member.
Close	Close the Group contents box.